| Package | Affected versions | Patched versions |
|---|---|---|
| io.jenkins.blueocean:blueocean-parent | < 1.25.4 | 1.25.4 |
| blue ocean | ≤ 1.25.3 |
Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server. Blue Ocean Plugin 1.25.4 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free