GHSA-jqr2-7f24-xrgc

Source

https://github.com/advisories/GHSA-jqr2-7f24-xrgc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-jqr2-7f24-xrgc/GHSA-jqr2-7f24-xrgc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jqr2-7f24-xrgc

Aliases

CVE-2023-50779

Published

2023-12-13T18:31:04Z

Modified

2024-02-16T08:12:43.445289Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Missing permission check in Jenkins PaaSLane Estimate Plugin

Details

PaaSLane Estimate Plugin 1.0.4 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified token.

Database specific

{
    "cwe_ids": [
        "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-13T19:45:06Z",
    "nvd_published_at": "2023-12-13T18:15:44Z",
    "severity": "MODERATE"
}

References

Affected packages

Maven / com.cloudtp.jenkins:paaslane-estimate

Package

Name: com.cloudtp.jenkins:paaslane-estimate; View open source insights on deps.dev
Purl: pkg:maven/com.cloudtp.jenkins/paaslane-estimate

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.0.4

Affected versions

1.*

1.0.0

1.0.3

1.0.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-jqr2-7f24-xrgc/GHSA-jqr2-7f24-xrgc.json"