Improper authorization control for web services In org.jenkins-ci.plugins:gitlab-plugin
Description
Missing permission check in Jenkins GitLab Plugin Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. An enumeration of credentials IDs in GitLab Plugin 1.5.32 requires the appropriate permissions.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 1.5.32 |
Aliases
1. 2. 3. 4.
References
1. 2.