Description

An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows users with Overall/Read permission to read and write the Black Duck Hub plugin configuration.

Remediation

References

https://jenkins.io/security/advisory/2018-05-09/#SECURITY-670

Related Vulnerabilities

CVE-2014-3574 Vulnerability in maven package org.apache.poi:poi-ooxml

CVE-2012-0022 Vulnerability in maven package tomcat:catalina

CVE-2019-10089 Vulnerability in maven package org.apache.jspwiki:jspwiki-war

CVE-2008-0128 Vulnerability in maven package tomcat:catalina

CVE-2020-6429 Vulnerability in npm package electron

Severity

Critical

Classification

CWE-863 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Tags

Vendor Advisory