| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:quayio-trigger | ≤ 0.1 | |
| quay.io trigger | ≤ 0.1 |
Jenkins Quay.io trigger Plugin provides a webhook endpoint at /quayio-webhook/ that can be used to trigger builds of jobs configured to use a specified repository.
In Quay.io trigger Plugin 0.1 and earlier, this endpoint can be accessed without authentication.
This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free