Missing permission check in Jenkins Project Inheritance Plugin

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-2197 · ADVISORY
• github/advisory-database#1356 · WEB
• jenkins.io/security/advisory/2020-06-03 · WEB
• openwall.com/lists/oss-security/2020/06/03/3 · WEB

hudson.plugins:project-inheritance のその他の脆弱性

• CVE-2022-34787中 5.4Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site…
• CVE-2020-2198中 6.5Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting …
• CVE-2019-10409中 4.3A missing permission check in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers with Overall/Read permission to trigger…
• CVE-2019-10408中 4.3A cross-site request forgery vulnerability in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers to trigger project gene…
• CVE-2019-10407中 6.5Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive v…