Medium · 4.3 CVE-2019-10377 GHSA-mg72-h5gj-8gg7

Missing permission check in Jenkins Avatar Plugin

Published Aug 7, 2019 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Avatar Plugin Package: net.hurstfrost.jenkins:avatar Category: Web / CMS Ecosystem: Maven

Description

A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Avatar Plugin	1.2 and earlier	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	net.hurstfrost.jenkins:avatar	all versions	—	GHSA-mg72-h5gj-8gg7

References

[oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins mailing-list
https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1099