| Package | Affected versions | Patched versions |
|---|---|---|
| io.jenkins.plugins:benchmark-evaluator | ≤ 1.0.1 | |
| benchmark evaluator | ≤ 1.0.1 |
Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier does not perform a permission check in a method implementing form validation.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system.
Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free