MEDIUM4.3
GHSA-p334-gfhq-c7w6
Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths
Quick fix
GHSA-p334-gfhq-c7w6 — org.jenkins-ci.plugins:script-security: upgrade to the fixed version with the command below.
# pom.xml: bump <version>1402.v94c9ce464861</version> for org.jenkins-ci.plugins:script-securityDetails
Jenkins Script Security Plugin versions 1399.ve6a_66547f6e1 and earlier do not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
Script Security Plugin 1402.v94c9ce464861 requires Overall/Administer permission to enumerate pending and approved Script Security classpaths.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.jenkins-ci.plugins:script-security
Introduced in:
0Fixed in: 1402.v94c9ce464861Fix
# pom.xml: bump <version>1402.v94c9ce464861</version> for org.jenkins-ci.plugins:script-security