Improper authorization control for web services In org.jenkins-ci.plugins:script-security
Description
Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths Jenkins Script Security Plugin versions 1399.ve6a_66547f6e1 and earlier do not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
Script Security Plugin 1402.v94c9ce464861 requires Overall/Administer permission to enumerate pending and approved Script Security classpaths.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 1402.v94c9ce464861 |
Aliases
1. 2. 3. 4.
References
1.