org.jenkins-ci.plugins:role-strategy (=675.va_5f27678f6d6) potentially affected by CVE-2024-52552 via org.jenkins-ci.plugins:authorize-project (=1.7.0)

org.jenkins-ci.plugins:authorize-project MAVEN version =1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:authorize-project and may be impacted: - org.jenkins-ci.plugins:role-strategy =675.va5f27678f6d6 Source cves:...

com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter (>=1.0.0 <=1.0.1) potentially affected by CVE-2023-28668 via org.jenkins-ci.plugins:role-strategy (=2.1.0)

org.jenkins-ci.plugins:role-strategy MAVEN version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:role-strategy and may be impacted: - com.moded.extendedchoiceparameter:dynamicextendedchoiceparameter =1.0.0, =1.0.1 Source...

com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter (>=1.0.0 <=1.0.1) potentially affected by CVE-2021-21624 via org.jenkins-ci.plugins:role-strategy (=2.1.0)

org.jenkins-ci.plugins:role-strategy MAVEN version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:role-strategy and may be impacted: - com.moded.extendedchoiceparameter:dynamicextendedchoiceparameter =1.0.0, =1.0.1 Source...

com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter (>=1.0.0 <=1.0.1) potentially affected by CVE-2017-1000090 via org.jenkins-ci.plugins:role-strategy (=2.1.0)

org.jenkins-ci.plugins:role-strategy MAVEN version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:role-strategy and may be impacted: - com.moded.extendedchoiceparameter:dynamicextendedchoiceparameter =1.0.0, =1.0.1 Source...

Incorrect permission checks in role-strategy may allow accessing some items

Items like jobs can be organized hierarchically in Jenkins, using the Folders Plugin or something similar. An item is expected to be accessible only if all its ancestors are accessible as well. role-strategy 3.1 and earlier does not correctly perform permission checks to determine whether an item...