CVE-2018-1000105

The CVE-2018-1000105 entry corresponds to an information-disclosure flaw in the Jenkins Gerrit Trigger Plugin (versions 2.27.4 and earlier). The root cause is improper authorization in GerritManagement.java, GerritServer.java, and PluginImpl.java, allowing an attacker with Overall/Read access to ...

CVE-2018-1000105

An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to retrieve some configuration information about Gerrit in Jenkins...

PT-2018-9284

Name of the Vulnerable Software and Affected Versions: Jenkins Gerrit Trigger Plugin versions 2.27.4 and earlier Description: An improper authorization issue exists that allows an attacker with Overall/Read access to retrieve some configuration information about Gerrit in Jenkins. This is due to...

CVE-2018-1000106: Incorrect Authorization

An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to modify the Gerrit configuration in Jenkins...

PT-2018-9285

Name of the Vulnerable Software and Affected Versions: Jenkins Gerrit Trigger Plugin versions 2.27.4 and earlier Description: An improper authorization issue exists that allows an attacker with Overall/Read access to modify the Gerrit configuration in Jenkins. This issue is related to the...

CVE-2018-1000105: Incorrect Authorization

An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to retrieve some configuration information about Gerrit in Jenkins...

Improper access control in Gerrit Trigger Plugin allowed unauthorized users to read some server configuration information

Missing permission checks in Gerrit Trigger Plugin allowed users with Overall/Read permission to access a form that showed the configuration of Gerrit servers in Jenkins. The key file password was only shown in its encrypted form, if configured. Other options were plainly visible. The missing...