~ / search / GHSA-w53q-r5cw-6vjh

GHSA-w53q-r5cw-6vjh

Missing permission check in Jenkins Project Inheritance Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2198

Packages

EcosystemPackageAffectedFixed in
Maven hudson.plugins:project-inheritance <= 21.04.03 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Project Inheritance Plugin 21.04.03 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting job config.xml data to users without Job/Configure.

References

External links from the advisory. They lead to third-party sites.