Description
A missing permission check in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Remediation
References
https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2249
Related Vulnerabilities
CVE-2023-41049 Vulnerability in npm package @dcl/single-sign-on-client
CVE-2024-4367 Vulnerability in maven package org.webjars.npm:pdfjs-dist
CVE-2023-29204 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore
CVE-2022-28731 Vulnerability in maven package org.apache.jspwiki:jspwiki-war
CVE-2012-5636 Vulnerability in maven package org.apache.wicket:wicket