Missing webhook endpoint authorization in Jenkins Rundeck Plugin

2022-09-2200:00:28

Google

osv.dev

0.001 Low

EPSS

Percentile

42.6%

JSON

Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to trigger jobs that are configured to be triggerable via Rundeck.

CPENameOperatorVersion
org.jenkins-ci.plugins:rundeckeq1.8
org.jenkins-ci.plugins:rundeckeq2.0.1
org.jenkins-ci.plugins:rundeckeq3.5.1
org.jenkins-ci.plugins:rundeckeq3.6.1
org.jenkins-ci.plugins:rundeckeq1.5.1
org.jenkins-ci.plugins:rundeckeq3.6.3
org.jenkins-ci.plugins:rundeckeq3.3
org.jenkins-ci.plugins:rundeckeq3.6.6
org.jenkins-ci.plugins:rundeckeq2.10
org.jenkins-ci.plugins:rundeckeq3.6.7

Name	Operator	Version
org.jenkins-ci.plugins:rundeck	eq	1.8
org.jenkins-ci.plugins:rundeck	eq	2.0.1
org.jenkins-ci.plugins:rundeck	eq	3.5.1
org.jenkins-ci.plugins:rundeck	eq	3.6.1
org.jenkins-ci.plugins:rundeck	eq	1.5.1
org.jenkins-ci.plugins:rundeck	eq	3.6.3
org.jenkins-ci.plugins:rundeck	eq	3.3
org.jenkins-ci.plugins:rundeck	eq	3.6.6
org.jenkins-ci.plugins:rundeck	eq	2.10
org.jenkins-ci.plugins:rundeck	eq	3.6.7