PT-2019-14709 · Jenkins · Jenkins Build Failure Analyzer Plugin+1
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Jenkins Build Failure Analyzer Plugin versions 1.24.1 and earlier
Description
A missing permission check in the plugin allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression.
Recommendations
For Jenkins Build Failure Analyzer Plugin versions 1.24.1 and earlier, update to a version that includes the missing permission check to prevent exploitation.
Correção
Incorrect Default Permissions
Improper Access Control
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Jenkins
Jenkins Build Failure Analyzer Plugin