Description

A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

Remediation

References

http://www.securityfocus.com/bid/108045

https://jenkins.io/security/advisory/2019-04-17/#SECURITY-983

Related Vulnerabilities

CVE-2020-7672 Vulnerability in npm package mosc

CVE-2022-45146 Vulnerability in maven package org.bouncycastle:bc-fips-debug

CVE-2020-15779 Vulnerability in npm package socket.io-file

CVE-2016-1000236 Vulnerability in npm package cookie-signature

CVE-2018-20834 Vulnerability in npm package tar

Severity

High

Classification

CWE-862 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Tags

Third Party Advisory VDB Entry Vendor Advisory