Description
Jenkins Favorite Plugin 2.1.4 and older does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites
Remediation
References
http://www.securityfocus.com/bid/101946
https://jenkins.io/security/advisory/2017-06-06/
Related Vulnerabilities
CVE-2023-28708 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2014-3120 Vulnerability in maven package org.elasticsearch:elasticsearch
CVE-2016-4800 Vulnerability in maven package org.eclipse.jetty:jetty-util
CVE-2023-30523 Vulnerability in maven package org.jenkins-ci.plugins:reportportal
CVE-2013-7398 Vulnerability in maven package com.ning:async-http-client