Description
Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission.
Remediation
References
Related Vulnerabilities
Perl Permissions, Privileges, and Access Controls Vulnerability (CVE-2008-2827)
Moodle Configuration Vulnerability (CVE-2011-4585)
WordPress Plugin Login by Auth0 Multiple Vulnerabilities (3.11.3)
Ruby CVE-2018-16396 Vulnerability (CVE-2018-16396)
WordPress Plugin IWantOneButton 'updateAJAX.php' SQL Injection (3.0.1)