| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:script-security | < 1402.v94c9ce464861 | 1402.v94c9ce464861 |
| script security | ≤ 1399.ve6a_66547f6e1 |
Jenkins Script Security Plugin versions 1399.ve6a_66547f6e1 and earlier do not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
Script Security Plugin 1402.v94c9ce464861 requires Overall/Administer permission to enumerate pending and approved Script Security classpaths.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free