GHSA-c445-xm3f-hmfh

Incorrect permission check in Health Advisor by CloudBees Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2258

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:cloudbees-jenkins-advisor	< 3.2.1	3.2.1

Details

As written in the advisory (Markdown source, shown as plain text).

Health Advisor by CloudBees Plugin 3.2.0 and earlier does not correctly perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to view an administrative configuration page. Health Advisor by CloudBees Plugin 3.2.1 requires Overall/Administer to view its administrative configuration page.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2258 advisory
https://github.com/jenkinsci/cloudbees-jenkins-advisor-plugin/commit/90f693a4b9fc60292463ecd7aa06c2c53d9dea30 web
https://github.com/jenkinsci/cloudbees-jenkins-advisor-plugin package
https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1998 web
http://www.openwall.com/lists/oss-security/2020/09/16/3 web