| Package | Affected versions | Patched versions |
|---|---|---|
| io.alauda.jenkins.plugins:alauda-kubernetes-support | ≤ 2.3.0 | |
| alauda kubernetes support | ≤ 2.3.0 |
A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free