GHSA-fpg6-xqj4-j7wf
Jenkins Jira Plugin Incorrect Authorization vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:jira | < 3.0.2 | 3.0.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. In version 3.0.2, this form validation method requires POST requests and Overall/Administer (for globally defined sites) or Item/Configure permissions (for sites defined for a folder).
References
External links from the advisory. They lead to third-party sites.