GHSA-w9gq-8q35-3jcc

Source

https://github.com/advisories/GHSA-w9gq-8q35-3jcc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-w9gq-8q35-3jcc/GHSA-w9gq-8q35-3jcc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w9gq-8q35-3jcc

Aliases

CVE-2018-1000111

Published

2022-05-13T01:48:32Z

Modified

2024-02-16T08:18:21.700665Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Jenkins Subversion Plugin Incorrect Authorization vulnerability

Details

An improper authorization vulnerability exists in Jenkins Subversion Plugin version 2.10.2 and earlier in SubversionStatus.java and SubversionRepositoryStatus.java that allows an attacker with network access to obtain a list of nodes and users. As of version 2.10.3, the class handling requests to /subversion/ no longer extends the class handling requests to the …/search/ sub-path, therefore any such requests will fail.

Database specific

{
    "nvd_published_at": "2018-03-13T13:29:00Z",
    "severity": "MODERATE",
    "github_reviewed_at": "2022-12-07T18:15:59Z",
    "cwe_ids": [
        "CWE-863"
    ],
    "github_reviewed": true
}

References

Affected packages

Maven / org.jenkins-ci.plugins:subversion

Package

Name: org.jenkins-ci.plugins:subversion; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/subversion

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.10.3

Affected versions

1.*

1.24

1.25

1.26

1.28

1.29

1.30

1.31

1.32

1.33

1.34

1.35

1.36

1.37

1.38

1.39

1.40

1.41

1.42

1.43

1.44

1.45

1.48

1.50

1.51

1.53

1.54

2.*

2.0-alpha-1

2.0-beta-1

2.0

2.1

2.2

2.3

2.4

2.4.1

2.4.2

2.4.3

2.4.4

2.4.5

2.5-beta-1

2.5-beta-2

2.5-beta-3

2.5-beta-4

2.5

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.5.6

2.5.7

2.6

2.7.1

2.7.1.1

2.7.2

2.8

2.9

2.10

2.10.1

2.10.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-w9gq-8q35-3jcc/GHSA-w9gq-8q35-3jcc.json"

last_known_affected_version_range

"<= 2.10.2"