CVE-2019-10474

Name of the Vulnerable Software and Affected Versions Jenkins Global Post Script Plugin (affected versions not specified)

Description The issue is related to a missing permission check in the Jenkins Global Post Script Plugin. This allows users with Overall/Read access to list the scripts available to the plugin stored on the Jenkins master file system. Specifically, it enables users to list the files contained in $JENKINS HOME/global-post-script that can be used by the plugin, due to the lack of permission checks on a method implementing form validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.