Missing Authorization in Jenkins P4 plugin

2021-06-1617:29:35

Google

osv.dev

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.3%

JSON

Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password.

Jenkins P4 Plugin 1.11.5 requires Overall/Administer for the affected HTTP endpoints.

CPENameOperatorVersion
org.jenkins-ci.plugins:p4eq1.2.0
org.jenkins-ci.plugins:p4eq1.3.9
org.jenkins-ci.plugins:p4eq1.8.10
org.jenkins-ci.plugins:p4eq1.8.0
org.jenkins-ci.plugins:p4eq1.10.9
org.jenkins-ci.plugins:p4eq1.4.0
org.jenkins-ci.plugins:p4eq1.11.3
org.jenkins-ci.plugins:p4eq1.3.3
org.jenkins-ci.plugins:p4eq1.6.2
org.jenkins-ci.plugins:p4eq1.8.15

Name	Operator	Version
org.jenkins-ci.plugins:p4	eq	1.2.0
org.jenkins-ci.plugins:p4	eq	1.3.9
org.jenkins-ci.plugins:p4	eq	1.8.10
org.jenkins-ci.plugins:p4	eq	1.8.0
org.jenkins-ci.plugins:p4	eq	1.10.9
org.jenkins-ci.plugins:p4	eq	1.4.0
org.jenkins-ci.plugins:p4	eq	1.11.3
org.jenkins-ci.plugins:p4	eq	1.3.3
org.jenkins-ci.plugins:p4	eq	1.6.2
org.jenkins-ci.plugins:p4	eq	1.8.15