Missing permission check in Jenkins CloudBees CD Plugin allows scheduling builds

Description

References

• nvd.nist.gov/vuln/detail/CVE-2021-21647 · ADVISORY
• jenkinsci/electricflow-plugin commit 597cbb1 · WEB
• jenkinsci/electricflow-plugin · PACKAGE
• jenkins.io/security/advisory/2021-04-21 · WEB
• openwall.com/lists/oss-security/2021/04/21/2 · WEB

Más vulnerabilidades de org.jenkins-ci.plugins:electricflow

• CVE-2023-46655MEDIO 6.5Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are publish…
• CVE-2023-46654ALTO 8.1Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup proc…
• CVE-2019-10336MEDIO 6.1A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output…
• CVE-2019-10335MEDIO 5.4A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in Jen…
• CVE-2019-10334MEDIO 6.5Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartU…