Description
Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins global-build-stats Plugin | ≤ 322.v22f4db_18e2dd | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:global-build-stats | < 347.v32a | 347.v32a | GHSA-gm8g-fh49-qq6v |
Advisories 1
- WID-SEC-2025-1966 Jenkins Plugins: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen BSI CERT-Bund (WID) · Sep 3, 2025
References
- Jenkins Security Advisory 2025-09-03 vendor-advisory