GHSA-jr86-6j4j-mv45

Source

https://github.com/advisories/GHSA-jr86-6j4j-mv45

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-jr86-6j4j-mv45/GHSA-jr86-6j4j-mv45.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jr86-6j4j-mv45

Aliases

CVE-2023-30521

Published

2023-04-12T18:30:36Z

Modified

2023-11-08T04:12:23.874972Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Jenkins Assembla merge request builder Plugin missing authentication to access endpoint

Details

Jenkins Assembla merge request builder Plugin provides a webhook endpoint at /assembla-webhook/ that can be used to trigger builds of jobs configured to use a specified repository.

In Assembla merge request builder Plugin 1.1.13 and earlier, this endpoint can be accessed without authentication. This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.

Database specific

{
    "nvd_published_at": "2023-04-12T18:15:00Z",
    "github_reviewed_at": "2023-04-12T22:18:11Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-862"
    ]
}

References

Affected packages

Maven / org.jenkins-ci.plugins:assembla-merge-request-builder

Package

Name: org.jenkins-ci.plugins:assembla-merge-request-builder; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/assembla-merge-request-builder

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.1.13

Affected versions

1.*

1.1.1

1.1.3

1.1.4

1.1.6

1.1.7

1.1.9

1.1.11

1.1.12

1.1.13