Description
The Exclusion plugin before 0.9 for Jenkins does not properly prevent access to resource locks, which allows remote authenticated users to list and release resources via unspecified vectors.
Remediation
References
https://wiki.jenkins-ci.org/display/JENKINS/Exclusion-Plugin
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-11-20
Related Vulnerabilities
CVE-2020-13946 Vulnerability in maven package org.apache.cassandra:cassandra-all
CVE-2022-43426 Vulnerability in maven package io.jenkins.plugins:s3explorer
CVE-2019-10464 Vulnerability in maven package org.jenkins-ci.plugins:weblogic-deployer-plugin
CVE-2023-50767 Vulnerability in maven package org.sonatype.nexus.ci:nexus-jenkins-plugin
CVE-2019-10395 Vulnerability in maven package org.jenkins-ci.plugins:build-environment