GHSA-5hw2-327v-vvr6

Missing permission check in Jenkins Implied Labels Plugin allows reconfiguring the plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2282

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:implied-labels	< 0.7	0.7

Details

As written in the advisory (Markdown source, shown as plain text).

Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to configure the plugin. Implied Labels Plugin 0.7 requires Overall/Administer permission to configure the plugin.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2282 advisory
https://github.com/jenkinsci/implied-labels-plugin/commit/9a5d38f8056a830ef075f379fa1b489c08f7000f web
https://github.com/jenkinsci/implied-labels-plugin package
https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-2004 web
http://www.openwall.com/lists/oss-security/2020/09/23/1 web