Missing Authorization in Jenkins Configuration as Code Plugin

2022-05-2416:51:50

Google

osv.dev

0.001 Low

EPSS

Percentile

22.2%

JSON

Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access the generated schema and documentation for this plugin containing detailed information about installed plugins.

CPENameOperatorVersion
io.jenkins:configuration-as-codeeq1.17
io.jenkins:configuration-as-codeeq1.21
io.jenkins:configuration-as-codeeq1.0-rc3
io.jenkins:configuration-as-codeeq1.9
io.jenkins:configuration-as-codeeq1.2
io.jenkins:configuration-as-codeeq1.0-rc2
io.jenkins:configuration-as-codeeq0.10-alpha
io.jenkins:configuration-as-codeeq1.8
io.jenkins:configuration-as-codeeq1.12
io.jenkins:configuration-as-codeeq1.19

Name	Operator	Version
io.jenkins:configuration-as-code	eq	1.17
io.jenkins:configuration-as-code	eq	1.21
io.jenkins:configuration-as-code	eq	1.0-rc3
io.jenkins:configuration-as-code	eq	1.9
io.jenkins:configuration-as-code	eq	1.2
io.jenkins:configuration-as-code	eq	1.0-rc2
io.jenkins:configuration-as-code	eq	0.10-alpha
io.jenkins:configuration-as-code	eq	1.8
io.jenkins:configuration-as-code	eq	1.12
io.jenkins:configuration-as-code	eq	1.19