~ / search / GHSA-268v-2qq7-84pf

GHSA-268v-2qq7-84pf

Missing permission check in Jenkins Favorite Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2017-1000243

Packages

EcosystemPackageAffectedFixed in
Maven org.jvnet.hudson.plugins:favorite < 2.3.0 2.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Favorite Plugin up to and including 2.1.0 does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites

References

External links from the advisory. They lead to third-party sites.