PT-2025-36621 · Maven · Org.Jenkins-Ci.Plugins:Global-Build-Stats

Publicado 2025-09-03 · Atualizado 2025-09-03

OSV

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins global-build-stats Plugin 322.v22f4db 18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs.

This has been patched in version 347.v32a eb 0493c4f.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

GHSA-GM8G-FH49-QQ6V

Produtos afetados

Org.Jenkins-Ci.Plugins:Global-Build-Stats

Referências · 5

• https://github.com/jenkinsci/global-build-stats-plugin/commit/32aeb0493c4ff5423448576f477ac612f7a25138 · Nota
• https://github.com/jenkinsci/global-build-stats-plugin · Nota
• https://osv.dev/vulnerability/GHSA-gm8g-fh49-qq6v · Aviso do Fabricante
• https://jenkins.io/security/advisory/2025-09-03/#SECURITY-3535 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-58459 · Nota de Segurança