Description

A missing permission check in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers with Overall/Read permission to send a fixed email to an attacker-specific recipient.

Remediation

References

https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1708

Related Vulnerabilities

CVE-2023-48240 Vulnerability in maven package org.xwiki.platform:xwiki-platform-security-authentication-default

CVE-2023-4303 Vulnerability in maven package org.jenkins-ci.plugins:fortify

CVE-2020-13920 Vulnerability in maven package org.apache.activemq:activemq-core

CVE-2016-4978 Vulnerability in maven package org.apache.activemq:artemis-jms-client

CVE-2023-46998 Vulnerability in maven package org.webjars.bower:bootbox.js

Severity

Medium

Classification

CWE-862 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Tags

Vendor Advisory