| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:fortify-on-demand-uploader | < 6.0.1 | 6.0.1 |
| fortify on demand | ≤ 5.0.1 |
A missing permission check in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs.
This form validation method requires appropriate permission in Fortify on Demand Plugin 6.0.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free