CVE-2019-10377
Missing permission check in Jenkins Avatar Plugin
Summary
Missing permission check in Jenkins Avatar Plugin
Original description
The description as published by the source.
A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Maven
net.hurstfrost.jenkins:avatar
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
References
- advisory nvd.nist.gov
- web jenkins.io
- web openwall.com