~ / search / GHSA-crvq-mw2w-4cfx

GHSA-crvq-mw2w-4cfx

Jenkins Black Duck Hub Plugin allowed any user with Overall/Read to read and write its configuration

Source: GitHub Advisory Database (reviewed) High CVE-2018-1000197

Packages

EcosystemPackageAffectedFixed in
Maven com.blackducksoftware.integration:blackduck-hub < 3.1.0 3.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows users with Overall/Read permission to read and write the Black Duck Hub plugin configuration.

References

External links from the advisory. They lead to third-party sites.