PT-2019-11773 · Jenkins · Jenkins Avatar Plugin+1
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Jenkins Avatar Plugin versions 1.2 and earlier
Description
A missing permission check in the plugin allows attackers with Overall/Read access to change the avatar of any user of Jenkins.
Recommendations
For Jenkins Avatar Plugin versions 1.2 and earlier, update to a version that includes the necessary permission checks to prevent unauthorized changes to user avatars.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jenkins
Jenkins Avatar Plugin