~ / search / GHSA-p334-gfhq-c7w6

GHSA-p334-gfhq-c7w6

Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-42519

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:script-security < 1402.v94c9ce464861 1402.v94c9ce464861

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Script Security Plugin versions 1399.ve6a_66547f6e1 and earlier do not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths. Script Security Plugin 1402.v94c9ce464861 requires Overall/Administer permission to enumerate pending and approved Script Security classpaths.

References

External links from the advisory. They lead to third-party sites.