Missing permission check in Jenkins XebiaLabs XL Deploy Plugin

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2019-10305 · ADVISORY
• jenkinsci/xldeploy-plugin commit 5acf9d7 · WEB
• jenkins.io/security/advisory/2019-04-17 · WEB
• securityfocus.com/bid/108045 · WEB

com.xebialabs.deployit.ci:deployit-plugin のその他の脆弱性

• CVE-2021-21665高 8.8A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an…
• CVE-2021-21664中 6.5An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to co…
• CVE-2021-21663中 4.3A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect …
• CVE-2021-21662中 4.3A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Overall/Read permission to enumera…
• CVE-2019-10304中 6.5A cross-site request forgery vulnerability in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validatio…