Description

Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access to obtain information about the Jenkins ElectricFlow Plugin configuration and configuration of connected ElectricFlow instances.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/06/11/1

http://www.securityfocus.com/bid/108747

https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1410%20%282%29

Related Vulnerabilities

CVE-2021-27516 Vulnerability in npm package urijs

CVE-2019-1003052 Vulnerability in maven package org.jenkins-ci.plugins:aws-beanstalk-publisher-plugin

CVE-2022-41255 Vulnerability in maven package org.jenkins-ci.plugins:cons3rt

CVE-2022-23496 Vulnerability in maven package nl.basjes.parse.useragent:yauaa-flink-table

CVE-2021-23358 Vulnerability in maven package org.webjars.bowergithub.jashkenas:underscore

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Mailing List Third Party Advisory VDB Entry CWE-862