PT-2019-14709 · Jenkins · Jenkins Build Failure Analyzer Plugin+1
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Jenkins Build Failure Analyzer Plugin versions 1.24.1 and earlier
Description
A missing permission check in the plugin allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression.
Recommendations
For Jenkins Build Failure Analyzer Plugin versions 1.24.1 and earlier, update to a version that includes the missing permission check to prevent exploitation.
Fix
Incorrect Default Permissions
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Jenkins
Jenkins Build Failure Analyzer Plugin