Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Missing Authorization

2022-09-2200:00:28

Google

osv.dev

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

42.9%

JSON

A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to connect to an attacker-specified webserver using attacker-specified credentials. Version 4.8.0.130 requires POST requests and Overall/Administer permission for the affected form validation method.

CPENameOperatorVersion
io.jenkins.plugins:cavisson-ns-nd-integrationeq4.6.1.79
io.jenkins.plugins:cavisson-ns-nd-integrationeq4.6.1.80
io.jenkins.plugins:cavisson-ns-nd-integrationeq4.6.0.24
io.jenkins.plugins:cavisson-ns-nd-integrationeq4.6.1.66
io.jenkins.plugins:cavisson-ns-nd-integrationeq4.6.0.23
io.jenkins.plugins:cavisson-ns-nd-integrationeq4.6.1.85
io.jenkins.plugins:cavisson-ns-nd-integrationeq4.6.1.68
io.jenkins.plugins:cavisson-ns-nd-integrationeq4.6.1.65
io.jenkins.plugins:cavisson-ns-nd-integrationeq4.6.1.83
io.jenkins.plugins:cavisson-ns-nd-integrationeq4.8.0.129

Name	Operator	Version
io.jenkins.plugins:cavisson-ns-nd-integration	eq	4.6.1.79
io.jenkins.plugins:cavisson-ns-nd-integration	eq	4.6.1.80
io.jenkins.plugins:cavisson-ns-nd-integration	eq	4.6.0.24
io.jenkins.plugins:cavisson-ns-nd-integration	eq	4.6.1.66
io.jenkins.plugins:cavisson-ns-nd-integration	eq	4.6.0.23
io.jenkins.plugins:cavisson-ns-nd-integration	eq	4.6.1.85
io.jenkins.plugins:cavisson-ns-nd-integration	eq	4.6.1.68
io.jenkins.plugins:cavisson-ns-nd-integration	eq	4.6.1.65
io.jenkins.plugins:cavisson-ns-nd-integration	eq	4.6.1.83
io.jenkins.plugins:cavisson-ns-nd-integration	eq	4.8.0.129