| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| org.jenkins-ci.plugins:contrast-continuous-application-security | < 3.12 | 3.12 |
| contrast continuous application security | ≤ 3.11 |
Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier does not perform a permission check in an HTTP endpoint that tests the connection to a Contrast TeamServer.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key.
Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Contrast Continuous Application Security Plugin 3.12 requires Overall/Administer permission and POST requests to test the connection to a Contrast TeamServer.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí