~ / search / GHSA-f9v6-p7hp-c3qx

GHSA-f9v6-p7hp-c3qx

Missing permission checks in Jenkins P4 Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2142

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:p4 < 1.10.11 1.10.11

Details

As written in the advisory (Markdown source, shown as plain text).

A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds or add labels in the Perforce repository. P4 Plugin 1.10.11 appropriate user permissions for the affected HTTP endpoints.

References

External links from the advisory. They lead to third-party sites.