| Package | Affected versions | Patched versions |
|---|---|---|
| io.jenkins.blueocean:blueocean | < 1.23.3 | 1.23.3 |
| blue ocean | ≤ 1.23.2 |
This entry previously misidentified the problematic behavior. The HTTP request itself is legitimate, but only authorized users should be able to perform it.
Blue Ocean Plugin 1.23.2 and earlier does not perform permission checks in several HTTP endpoints implementing connection tests.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Blue Ocean Plugin 1.23.3 requires Item/Create permission to perform these connection tests.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free