Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (2)
| Vulnerability |
Summary |
Aliases |
|
VCID-jj88-rbff-4ygb
|
Missing permission check in Blue Ocean Plugin
### Updated 2020-09-16
This entry previously misidentified the problematic behavior. The HTTP request itself is legitimate, but only authorized users should be able to perform it.
### Original Description
Blue Ocean Plugin 1.23.2 and earlier does not perform permission checks in several HTTP endpoints implementing connection tests.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Blue Ocean Plugin 1.23.3 requires Item/Create permission to perform these connection tests.
|
CVE-2020-2255
GHSA-vc7g-4269-f7hw
|
|
VCID-sa11-2uur-8ybd
|
Path traversal vulnerability in Blue Ocean Plugin
Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag, `blueocean.features.GIT_READ_SAVE_TYPE`, that when set to the value `clone` allows an attacker with Item/Configure or Item/Create permission to read arbitrary files on the Jenkins controller file system.
Blue Ocean Plugin 1.23.3 no longer includes this feature and redirects existing usage to a safer alternative.
|
CVE-2020-2254
GHSA-vq7j-6pcq-f48p
|