GHSA-7v7g-mh53-89hw
Missing permission check in Jenkins AWS Global Configuration Plugin allows replacing plugin configuration
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | io.jenkins.plugins:aws-global-configuration | < 1.6 | 1.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
Jenkins AWS Global Configuration Plugin 1.5 and earlier does not perform a permission check in an HTTP endpoint processing form submissions.
This allows attackers with Overall/Read permission to replace the global AWS configuration.
Jenkins AWS Global Configuration Plugin 1.6 properly performs permission checks when processing configuration form submissions.
References
External links from the advisory. They lead to third-party sites.