CVE-2019-10377
Missing permission check in Jenkins Avatar Plugin
Résumé
Missing permission check in Jenkins Avatar Plugin
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Maven
net.hurstfrost.jenkins:avatar
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Références
- advisory nvd.nist.gov
- web jenkins.io
- web openwall.com