GHSA-2q8v-439j-6p77

Jenkins Exclusion Plugin allows Access to Resource Locks

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-6373

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:exclusion	< 0.9	0.9

Details

As written in the advisory (Markdown source, shown as plain text).

The Exclusion plugin before 0.9 for Jenkins does not properly prevent access to resource locks, which allows remote authenticated users to list and release resources via unspecified vectors.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-6373 advisory
https://github.com/jenkinsci/exclusion-plugin/commit/847f9aeb407c0f47046d184080c9e2c2e3720311 web
https://github.com/jenkinsci/exclusion-plugin package
https://wiki.jenkins-ci.org/display/JENKINS/Exclusion-Plugin web
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-11-20 web