Improper authorization control for web services In org.jenkins-ci.main:jenkins-core
Description
Jenkins does not perform a permission check in an HTTP endpoint Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to access other users' "My Views". Attackers with global View/Configure and View/Delete permissions are also able to change other users' "My Views".
Jenkins 2.471, LTS 2.452.4, LTS 2.462.1 restricts access to a user’s "My Views" to the owning user and administrators.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 2.452.4, 2.462.1, 2.471 |
Aliases
1. 2. 3. 4.
References
1. 2. 3. 4.