Missing permission check in Jenkins Project Inheritance Plugin

2022-05-2417:19:05

Google

osv.dev

0.001 Low

EPSS

Percentile

28.4%

JSON

Jenkins Project Inheritance Plugin 21.04.03 and earlier does not redact encrypted secrets in the ‘getConfigAsXML’ API URL when transmitting job config.xml data to users without Job/Configure.

CPENameOperatorVersion
hudson.plugins:project-inheritanceeq1.5.0
hudson.plugins:project-inheritanceeq1.4.8
hudson.plugins:project-inheritanceeq1.4.11.1
hudson.plugins:project-inheritanceeq1.4.9
hudson.plugins:project-inheritanceeq1.5.1
hudson.plugins:project-inheritanceeq21.04.03
hudson.plugins:project-inheritanceeq1.4.12
hudson.plugins:project-inheritanceeq19.08.01
hudson.plugins:project-inheritanceeq19.08.02
hudson.plugins:project-inheritanceeq1.4.10

Name	Operator	Version
hudson.plugins:project-inheritance	eq	1.5.0
hudson.plugins:project-inheritance	eq	1.4.8
hudson.plugins:project-inheritance	eq	1.4.11.1
hudson.plugins:project-inheritance	eq	1.4.9
hudson.plugins:project-inheritance	eq	1.5.1
hudson.plugins:project-inheritance	eq	21.04.03
hudson.plugins:project-inheritance	eq	1.4.12
hudson.plugins:project-inheritance	eq	19.08.01
hudson.plugins:project-inheritance	eq	19.08.02
hudson.plugins:project-inheritance	eq	1.4.10