PT-2022-6109 · Jenkins · Jenkins Tuleap Git Branch Source Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Tuleap Git Branch Source Plugin versions 3.2.4 and earlier Description: The issue is related to a missing permission check in the Jenkins Tuleap Git Branch Source Plugin, allowing unauthenticated attackers to trigger Tuleap projects...

Lack of webhook authentication mechanism in tuleap-git-branch-source

tuleap-git-branch-source provides a webhook endpoint at /tuleap-hook/ that can be used to trigger Tuleap projects configured with a specified repository. In tuleap-git-branch-source 3.2.4 and earlier, this endpoint can be accessed without authentication. This allows unauthenticated attackers to...