PT-2018-9366 · Jenkins · Jenkins Black Duck Hub Plugin+1

Daniel Beck · Publicado 2018-06-05 · Atualizado 2022-05-13 · CVE-2018-1000197

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Black Duck Hub Plugin versions 3.0.3 and older

Description An improper authorization issue exists in the PostBuildScanDescriptor.java file, allowing users with Overall/Read permission to read and write the Black Duck Hub plugin configuration.

Recommendations For Jenkins Black Duck Hub Plugin versions 3.0.3 and older, update to a version newer than 3.0.3 to resolve the issue.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2018-1000197

GHSA-CRVQ-MW2W-4CFX

Produtos afetados

Jenkins

Jenkins Black Duck Hub Plugin

Referências · 4

• https://osv.dev/vulnerability/GHSA-crvq-mw2w-4cfx · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000197 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1000197 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2018-05-09/#SECURITY-670 · Aviso do Fabricante