Veracode Vulnerability DatabaseVERACODE:41417Missing Permission Check
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
0.001 Low
EPSS
Percentile
21.0%
org.jenkins-ci.plugins:elasticbox is vulnerable to Missing Permission Checks. The vulnerability exists because the library does not perform permission checks in several HTTP endpoints, which allows an attacker to connect to URLs with credentials obtained through a deferent method, resulting in stored credential capturing in Jenkins.
| CPE | Name | Operator | Version |
|---|---|---|---|
| elasticbox ci plug-in | le | 4.0.8 | |
| elasticbox ci plug-in | le | 4.0.8 |
Related
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
0.001 Low
EPSS
Percentile
21.0%