~ / search / GHSA-hcpw-v727-64qh

GHSA-hcpw-v727-64qh

Jenkins Team Concert Plugin does not perform permission checks in methods implementing form validation

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-3315

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:teamconcert < 2.4.2 2.4.2

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Team Concert Plugin 2.4.1 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. Team Concert Plugin 2.4.2 requires Overall/Administer permission for the affected form validation methods.

References

External links from the advisory. They lead to third-party sites.