1 matches found
Lack of authentication mechanism in fogbugz webhook
fogbugz provides a webhook endpoint at /fbTrigger/ that can be used to trigger builds of any jobs. In fogbugz 2.2.17 and earlier, this endpoint can be accessed by attackers with Item/Read permission, allowing them to trigger builds of jobs specified in a jobname request parameter. As of publicati...
4.3CVSS5.1AI score0.00448EPSS
SaveExploits0Affected Software1
20