Vulnerability GHSA-2r5w-jh6g-8hff
Medium Risk
MEDIUM RISK
CVSS Score: 5.4
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
3 months ago
June 24, 2026 at 03:31 PM UTC
Jenkins Assembla Plugin has a missing permission check
1.2.0 - 1.4.0
1.2.0 - 1.4.0
Summary
Jenkins Assembla Plugin has a missing permission check
Details
Jenkins Assembla Plugin 1.4 and earlier does not perform a permission check in an HTTP endpoint that tests the connection to an Assembla server.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password.
Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
3 months ago
Jenkins Assembla Plugin has an XXE vulnerability
1.2.0 - 1.4.0 GHSA-2q27-6p2h-q6r3
1.2.0 - 1.4.0 GHSA-2q27-6p2h-q6r3
Medium Risk
3 months ago
Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability
1.2.0 - 1.4.0 GHSA-429r-3j78-2pxm
1.2.0 - 1.4.0 GHSA-429r-3j78-2pxm
Low Risk
4 years ago
Jenkins Assembla Plugin has Insufficiently Protected Credentials
1.2.0 - 1.4.0 GHSA-mhq6-h9m7-wq8c
1.2.0 - 1.4.0 GHSA-mhq6-h9m7-wq8c
Impacted packages
Timeline
Published
3 months ago
June 24, 2026 at 03:31 PM UTC
Last Modified
2 days ago
September 25, 2026 at 08:00 PM UTC