GHSA-xxv9-w5hm-328j

Jenkins AppSpider Plugin missing permission checks

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-28155

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.rapid7:jenkinsci-appspider-plugin	< 1.0.17	1.0.17

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins AppSpider Plugin 1.0.16 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about available scan config names, engine group names, and client names.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-28155 advisory
https://github.com/jenkinsci/appspider-build-scanner-plugin/commit/1677f098fbe4c71d782fc4c7bab5f972c575a86d web
https://github.com/jenkinsci/appspider-build-scanner-plugin package
https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3144 web
http://www.openwall.com/lists/oss-security/2024/03/06/3 web