Lucene search

K
osvGoogleOSV:GHSA-M8F2-9282-X38V
HistoryMay 24, 2022 - 4:47 p.m.

Jenkins ElectricFlow Plugin Missing permission checks

2022-05-2416:47:43
Google
osv.dev
2

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.3%

Various form validation and form autocompletion methods in CloudBees CD Plugin lacked permission checks. This allowed attackers with Overall/Read access to obtain information about the configuration of CloudBees CD Plugin, as well as the configuration and data of connected ElectricFlow servers.

These form validation and autocompletion methods now require Overall/Administer or Job/Configure permission, as appropriate for the given method.

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.3%

Related for OSV:GHSA-M8F2-9282-X38V