Missing permission check in Jenkins SOASTA CloudTest Plugin

2022-05-1301:25:16

Google

osv.dev

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.1%

JSON

A missing permission check in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

CPENameOperatorVersion
com.soasta.jenkins:cloudtesteq2.18
com.soasta.jenkins:cloudtesteq2.20
com.soasta.jenkins:cloudtesteq2.3
com.soasta.jenkins:cloudtesteq2.25
com.soasta.jenkins:cloudtesteq2.24
com.soasta.jenkins:cloudtesteq2.16
com.soasta.jenkins:cloudtesteq2.17
com.soasta.jenkins:cloudtesteq2.23
com.soasta.jenkins:cloudtesteq2.12
com.soasta.jenkins:cloudtesteq2.19

Name	Operator	Version
com.soasta.jenkins:cloudtest	eq	2.18
com.soasta.jenkins:cloudtest	eq	2.20
com.soasta.jenkins:cloudtest	eq	2.3
com.soasta.jenkins:cloudtest	eq	2.25
com.soasta.jenkins:cloudtest	eq	2.24
com.soasta.jenkins:cloudtest	eq	2.16
com.soasta.jenkins:cloudtest	eq	2.17
com.soasta.jenkins:cloudtest	eq	2.23
com.soasta.jenkins:cloudtest	eq	2.12
com.soasta.jenkins:cloudtest	eq	2.19