GHSA-gpmw-h4wq-4rch

Missing permission check in Jenkins Project Inheritance Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-10409

Packages

Ecosystem	Package	Affected	Fixed in
Maven	hudson.plugins:project-inheritance	< 19.08.02	19.08.02

Details

As written in the advisory (Markdown source, shown as plain text).

A missing permission check in Jenkins Project Inheritance Plugin 19.08.01 and earlier allowed attackers with Overall/Read permission to trigger project generation from templates.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10409 advisory
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-401 web
http://www.openwall.com/lists/oss-security/2019/09/25/3 web