Jenkins global-build-stats Plugin missing permission check can result in graph IDs being enumerated

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2025-58459 · ADVISORY
• jenkinsci/global-build-stats-plugin commit 32aeb04 · WEB
• jenkinsci/global-build-stats-plugin · PACKAGE
• jenkins.io/security/advisory/2025-09-03 · WEB
• openwall.com/lists/oss-security/2025/09/03/4 · WEB

Lỗ hổng khác của org.jenkins-ci.plugins:global-build-stats

• CVE-2022-27207TRUNG BÌNH 4.8Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' pag…
• CVE-2017-1000389TRUNG BÌNH 6.1Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters. …