Jenkins Black Duck Hub Plugin allowed any user with Overall/Read to read and write its configuration

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2018-1000197 · ADVISORY
• jenkins.io/security/advisory/2018-05-09 · WEB

com.blackducksoftware.integration:blackduck-hub のその他の脆弱性

• CVE-2018-1000198中 6.5A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that …
• CVE-2018-1000190中 6.5A exposure of sensitive information vulnerability exists in Jenkins Black Duck Hub Plugin 4.0.0 and older in PostBuildScanDescriptor.java th…