Skip to content
OpenAdvisories
Medium · 6.5 CVE-2019-16539 EUVD-2022-4279GHSA-j52r-pmqv-wm38

Missing permission check in Jenkins Support Core Plugin

Published Nov 21, 2019 · Updated Aug 5, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Support Core Plugin Package: org.jenkins-ci.plugins:support-core Category: Web / CMS Ecosystem: Maven

Description

A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support bundles.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Support Core Plugin 2.63 and earlier —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:support-core < 2.64 2.64 GHSA-j52r-pmqv-wm38

References