GHSA-7j3x-xm4j-jfj7

Source

https://github.com/advisories/GHSA-7j3x-xm4j-jfj7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-7j3x-xm4j-jfj7/GHSA-7j3x-xm4j-jfj7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7j3x-xm4j-jfj7

Aliases

CVE-2021-21626

Published

2022-05-24T17:44:48Z

Modified

2024-02-16T08:20:00.726624Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Missing permission checks in Jenkins Warnings Next Generation Plugin allow listing workspace contents

Details

Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A sequence of requests can be used to effectively list workspace contents.

Jenkins Warnings Next Generation Plugin 8.5.0 requires Item/Configure permission to validate patterns with workspace contents.

Database specific

{
    "nvd_published_at": "2021-03-18T14:15:00Z",
    "cwe_ids": [
        "CWE-862"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-14T16:24:01Z"
}

References

Affected packages

Maven / io.jenkins.plugins:warnings-ng

Package

Name: io.jenkins.plugins:warnings-ng; View open source insights on deps.dev
Purl: pkg:maven/io.jenkins.plugins/warnings-ng

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.5.0

Affected versions

1.*

1.0.0-beta1

1.0.0-beta2

1.0.0-beta3

1.0.0-beta4

1.0.0-beta5

1.0.0-beta6

1.0.0-beta7

1.0.0-beta8

1.0.0-beta9

1.0.0-beta10

1.0.0

1.0.1

2.*

2.0.0

2.1.0

2.1.1

2.1.2

2.2.0

2.2.1

3.*

3.0.0

3.0.1

3.0.3

4.*

4.0.0

5.*

5.0.0

5.1.0

5.2.0

5.2.1

5.3.0

6.*

6.0.0

6.0.1

6.0.2

6.0.3

6.0.4

6.1.0

6.1.1

7.*

7.0.0

7.1.0

7.1.1

7.1.2

7.2.0

7.2.1

7.2.2

7.3.0

8.*

8.0.0-beta1

8.0.0-beta2

8.0.0-beta3

8.0.0-beta5

8.0.0-beta6

8.0.0-beta7

8.0.0-beta8

8.0.0

8.1.0

8.2.0

8.3.0

8.4.0

8.4.1

8.4.1.1

8.4.2

8.4.3

8.4.3.1

8.4.4

Database specific

{
    "last_known_affected_version_range": "<= 8.4.4"
}