GHSA-3h2q-m63q-9cf6
Missing permission check in Perfecto Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | io.jenkins.plugins:perfecto | < 1.18 | 1.18 |
Details
As written in the advisory (Markdown source, shown as plain text).
Perfecto Plugin 1.17 and earlier does not perform a permission check in a method implementing a connection test.
This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified username and password.
Perfecto Plugin 1.18 requires Overall/Administer permission to perform a connection test.
References
External links from the advisory. They lead to third-party sites.