Description
Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/11/21/1
https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1106
Related Vulnerabilities
CVE-2021-45458 Vulnerability in maven package org.apache.kylin:kylin-core-common
CVE-2020-9489 Vulnerability in maven package org.apache.tika:tika-parsers
CVE-2019-19771 Vulnerability in npm package rceat
CVE-2016-9879 Vulnerability in maven package org.springframework.security:spring-security-web
CVE-2018-20676 Vulnerability in maven package org.fujion.webjars:bootstrap