CVE-2024-28155

Name of the Vulnerable Software and Affected Versions Jenkins AppSpider Plugin versions 1.0.16 and earlier

Description The issue allows attackers with Overall/Read permission to obtain information about available scan config names, engine group names, and client names due to a lack of permission checks in several HTTP endpoints.

Recommendations For Jenkins AppSpider Plugin versions 1.0.16 and earlier, as a temporary workaround, consider restricting access to the affected HTTP endpoints until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.