GHSA-5xv9-gp22-gqm5
Missing permission checks in Jenkins Maven Cascade Release Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.barchart.jenkins:maven-release-cascade | <= 1.3.2 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Jenkins Maven Cascade Release Plugin 1.3.2 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to start cascade builds and layout builds, and reconfigure the plugin.
References
External links from the advisory. They lead to third-party sites.