~ / search / GHSA-4vf2-cm23-rf4c

GHSA-4vf2-cm23-rf4c

Incorrect Authorization in Jenkins Gerrit Trigger Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000106

Packages

EcosystemPackageAffectedFixed in
Maven com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger < 2.27.5 2.27.5

Details

As written in the advisory (Markdown source, shown as plain text).

An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to modify the Gerrit configuration in Jenkins.

References

External links from the advisory. They lead to third-party sites.