GHSA-h6qv-f5gf-8gcf
Missing Authorization in Jenkins P4 plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:p4 | < 1.11.5 | 1.11.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password.
Jenkins P4 Plugin 1.11.5 requires Overall/Administer for the affected HTTP endpoints.
References
External links from the advisory. They lead to third-party sites.