CVE-2019-10377
Missing permission check in Jenkins Avatar Plugin
概要
Missing permission check in Jenkins Avatar Plugin
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Maven
net.hurstfrost.jenkins:avatar
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
参照URL
- advisory nvd.nist.gov
- web jenkins.io
- web openwall.com