~ / search / GHSA-7rx6-4vwv-432g

GHSA-7rx6-4vwv-432g

Missing permission check in Jenkins CloudBees CD Plugin allows scheduling builds

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-21647

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:electricflow < 1.1.18.1 1.1.18.1
Maven org.jenkins-ci.plugins:electricflow >= 1.1.19, < 1.1.22 1.1.22

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins CloudBees CD Plugin does not perform a permission check in an HTTP endpoint. This allows attackers with Item/Read permission to schedule builds of projects without having Item/Build permission. Jenkins CloudBees CD Plugin requires Item/Build permission to schedule builds via its HTTP endpoint.

References

External links from the advisory. They lead to third-party sites.