Missing permission checks in Jenkins Database Plugin

2022-05-2417:27:06

Google

osv.dev

0.001 Low

EPSS

Percentile

22.2%

JSON

A missing permission check in Jenkins database Plugin 1.6 and earlier allows attackers with Overall/Read access to Jenkins to connect to an attacker-specified database server using attacker-specified credentials.

Database Plugin 1.7 requires Overall/Administer permission for the affected form validation method.

CPENameOperatorVersion
org.jenkins-ci.plugins:databaseeq1.4.1
org.jenkins-ci.plugins:databaseeq1.6
org.jenkins-ci.plugins:databaseeq1.3
org.jenkins-ci.plugins:databaseeq1.1
org.jenkins-ci.plugins:databaseeq1.0
org.jenkins-ci.plugins:databaseeq1.5
org.jenkins-ci.plugins:databaseeq1.4

Name	Operator	Version
org.jenkins-ci.plugins:database	eq	1.4.1
org.jenkins-ci.plugins:database	eq	1.6
org.jenkins-ci.plugins:database	eq	1.3
org.jenkins-ci.plugins:database	eq	1.1
org.jenkins-ci.plugins:database	eq	1.0
org.jenkins-ci.plugins:database	eq	1.5
org.jenkins-ci.plugins:database	eq	1.4