Missing permission check in Blue Ocean Plugin

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-2255 · ADVISORY
• jenkinsci/blueocean-plugin commit 659a66a · WEB
• jenkins.io/security/advisory/2020-09-16 · WEB
• openwall.com/lists/oss-security/2020/09/16/3 · WEB

io.jenkins.blueocean:blueocean のその他の脆弱性

• CVE-2023-40341高 8.8A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attacker…
• CVE-2020-2254中 6.5Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure…
• CVE-2019-1003013中 5.4An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/…
• CVE-2019-1003012中 6.5A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blue…
• CVE-2017-1000110中 4.3Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches co…