| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:ansible-tower | < 0.9.2 | 0.9.2 |
| ansible tower | ≤ 0.9.1 |
A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doFillTowerCredentialsIdItems method allowed attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free