| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:requests | < 2.2.17 | 2.2.17 |
| requests | ≤ 2.2.16 |
An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests. requests-plugin Plugin 2.2.17 requires Overall/Administer permission to view the list of pending requests.
This is basically the same vulnerability as SECURITY-1995, whose fix was ineffective.
requests-plugin Plugin 2.2.17 requires Overall/Administer permission to view the list of pending requests.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free