Description

A missing permission check in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Remediation

References

https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2745

Related Vulnerabilities

CVE-2010-1244 Vulnerability in maven package org.apache.activemq:activemq-web

CVE-2017-15010 Vulnerability in maven package org.webjars.npm:tough-cookie

CVE-2017-12620 Vulnerability in maven package org.apache.opennlp:opennlp-tools

CVE-2023-29526 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rendering-async-macro

CVE-2016-4465 Vulnerability in maven package org.apache.struts:struts2-core

Severity

High

Classification

CWE-862 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Tags

Vendor Advisory