Missing permission checks in Jenkins P4 Plugin

MOYENNE 4.3CVE-2020-2142 · GHSA-f9v6-p7hp-c3qx · Published 09/03/2020 · updated 17/06/2026

En bref

CVE-2020-2142 est une vulnérabilité MOYENNE (CVSS 4.3) touchant org.jenkins-ci.plugins:p4, p4 (jenkins).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.61%, plus élevée que 49.6% des vulnérabilités.
Correctif : mettre à jour vers 1.10.11 ou plus récent.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:p4 Maven	`< 1.10.11`	`1.10.11`
p4 jenkins	`≤ 1.10.10`	No fix yet

Description

A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds or add labels in the Perforce repository.

P4 Plugin 1.10.11 appropriate user permissions for the affected HTTP endpoints.

NVD description

A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds.

References

nvd.nist.gov/vuln/detail/CVE-2020-2142 · ADVISORY
jenkinsci/p4-plugin commit 2f2a31d · WEB
jenkinsci/p4-plugin · PACKAGE
jenkins.io/security/advisory/2020-03-09 · WEB
openwall.com/lists/oss-security/2020/03/09/1 · WEB

Autres vulnérabilités de org.jenkins-ci.plugins:p4

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:p4

Maven

< 1.10.11

1.10.11

jenkins

≤ 1.10.10

No fix yet

Description

A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds or add labels in the Perforce repository.

P4 Plugin 1.10.11 appropriate user permissions for the affected HTTP endpoints.

NVD description

A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds.

Autres vulnérabilités de org.jenkins-ci.plugins:p4

Tout voir →