Vulnerability GHSA-wg26-8wmj-cf9p

Medium Risk

5 months ago

Jenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test

1.0.0 - 1.10.1 and 2.4.5 - 2.4.6 and 2.6.0 and 2.8.0 and 2.8.2 - 2.8.3 and 2.9.9

Summary

Jenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test

Details

Jenkins GitHub Branch Source Plugin versions 1967.vdea_d580c1a_b_a_ and earlier do not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub App credentials.

GitHub Branch Source Plugin 1967.1969.v205fd594c821 requires Overall/Manage permission to perform the connection test.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk

3 months ago

Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs

1.0.0 - 1.10.1 and 2.4.5 - 2.4.6 and 2.6.0 and 2.8.0 and 2.8.2 - 2.8.3 and 2.9.9 GHSA-g7c6-wxjf-8564

Medium Risk

4 years ago

Jenkins GitHub Branch Source Plugin vulnerable to Cross-Site Request Forgery

1.0.0 - 1.10.1 GHSA-w66r-f5gg-gqwm

Medium Risk

4 years ago

Jenkins GitHub Branch Source Plugin allows any user with Overall/Read permission to get list of valid credentials IDs

1.0.0 - 1.10.1 GHSA-6jp2-hggx-8j7p

Medium Risk

4 years ago

Jenkins GitHub Branch Source Plugin vulnerable to Server-Side Request Forgery

1.0.0 - 1.10.1 GHSA-9cfq-v2hm-c3xr

View all vulnerabilities for these packages

Impacted packages

org.jenkins-ci.plugins:github-branch-source

Timeline

Published

5 months ago

Last Modified

4 months ago