Missing permission check in Jenkins Netsparker Cloud Scan Plugin

2022-05-1301:15:02

Google

osv.dev

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.1%

JSON

A missing permission check in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form validation method allowed attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

CPENameOperatorVersion
org.jenkins-ci.plugins:netsparker-cloud-scaneq1.1.5
org.jenkins-ci.plugins:netsparker-cloud-scaneq1.1.1
org.jenkins-ci.plugins:netsparker-cloud-scaneq1.1.0
org.jenkins-ci.plugins:netsparker-cloud-scaneq1.1.3
org.jenkins-ci.plugins:netsparker-cloud-scaneq1.1.2

Name	Operator	Version
org.jenkins-ci.plugins:netsparker-cloud-scan	eq	1.1.5
org.jenkins-ci.plugins:netsparker-cloud-scan	eq	1.1.1
org.jenkins-ci.plugins:netsparker-cloud-scan	eq	1.1.0
org.jenkins-ci.plugins:netsparker-cloud-scan	eq	1.1.3
org.jenkins-ci.plugins:netsparker-cloud-scan	eq	1.1.2