GHSA-436g-2f92-cvhh

Suggest an improvement
Source
https://github.com/advisories/GHSA-436g-2f92-cvhh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-436g-2f92-cvhh/GHSA-436g-2f92-cvhh.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-436g-2f92-cvhh
Aliases
Published
2023-04-02T21:30:17Z
Modified
2025-02-25T22:08:11.499262Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Jenkins Role-based Authorization Strategy Plugin grants permissions even after they’ve been disabled
Details

Permissions in Jenkins can be enabled and disabled. Some permissions are disabled by default, e.g., Overall/Manage or Item/Extended Read. Disabled permissions cannot be granted directly, only through greater permissions that imply them (e.g., Overall/Administer or Item/Configure).

Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they’ve been disabled.

This allows attackers to have greater access than they’re entitled to after the following operations took place:

A permission is granted to attackers directly or through groups.

The permission is disabled, e.g., through the script console.

Role-based Authorization Strategy Plugin 587.588.v850a20a30162 does not grant disabled permissions.

Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-03T22:55:17Z",
    "cwe_ids": [
        "CWE-281"
    ],
    "nvd_published_at": "2023-04-02T21:15:00Z",
    "severity": "MODERATE"
}
References

Affected packages

Maven / org.jenkins-ci.plugins:role-strategy

Package

Name
org.jenkins-ci.plugins:role-strategy
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/role-strategy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
587.588.v850a_20a_30162

Affected versions

1.*
1.1.2
1.1.3
2.*
2.1.0
2.2.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.6.0
2.6.1
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.10
2.11
2.12
2.13
2.14
2.15
2.16
3.*
3.0
3.1
3.1.1
3.2.0
483.*
483.v17281966f5c3
484.*
484.v8a_a_e4b_d785fd
488.*
488.v0634ce149b_8c
501.*
501.v88fe53d65c80
506.*
506.v13f908ee1fc9
508.*
508.v2a_f05b_05e9d8
510.*
510.v909834359ec2
521.*
521.vcf7a_3a_8dde42
526.*
526.v859673312a_14
530.*
530.ved5445d4875a_
546.*
546.ve16648865996
548.*
548.vb_60076577ec7
552.*
552.v14cb_85499b_89
555.*
555.v8d194cc85b_30
561.*
561.v9846c7351a_41
562.*
562.v44e9a_e828d0e
569.*
569.v7476f8e4fe29
575.*
575.v4d286a_03e6d7
584.*
584.vf8e515397ecd
587.*
587.v2872c41fa_e51

Database specific

last_known_affected_version_range 
"< 587.588.v850a"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-436g-2f92-cvhh/GHSA-436g-2f92-cvhh.json"