Description

A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Remediation

References

https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2248

Related Vulnerabilities

CVE-2023-30846 Vulnerability in npm package typed-rest-client

CVE-2023-29506 Vulnerability in maven package org.xwiki.platform:xwiki-platform-security-authentication-default

CVE-2018-11788 Vulnerability in maven package org.apache.karaf:org.apache.karaf.util

CVE-2023-46131 Vulnerability in maven package org.grails:grails-encoder

CVE-2020-17518 Vulnerability in maven package org.apache.flink:flink-runtime_2.11

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Tags

Vendor Advisory CWE-862