PT-2019-8729
CVE-2018-1000418
·
تاريخ النشر
2019-01-09
·
تاريخ التحديث
2022-05-13
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Jenkins HipChat Plugin versions 2.2.0 and earlier
Description
An improper authorization issue exists in the Jenkins HipChat Plugin, specifically in HipChatNotifier.java, allowing attackers with Overall/Read access to send test notifications to a specified HipChat server using attacker-specified credentials IDs. This could potentially capture credentials stored in Jenkins.
Recommendations
For Jenkins HipChat Plugin versions 2.2.0 and earlier, update to version 2.2.1 or later, which requires POST requests and Overall/Administer permissions for the form validation method, thereby mitigating the issue.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾