| Package | Affected versions | Patched versions |
|---|---|---|
| com.rapid7:jenkinsci-appspider-plugin | < 1.0.17 | 1.0.17 |
| appspider | < 1.0.17 | 1.0.17 |
Jenkins AppSpider Plugin 1.0.16 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about available scan config names, engine group names, and client names.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free