GitHub Advisory DatabaseGHSA-2C5C-FHR8-PWH9Jenkins AppSpider Plugin missing permission check
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
0.0005 Low
EPSS
Percentile
17.5%
Jenkins AppSpider Plugin 1.0.15 and earlier does not perform a permission check in a method implementing form validation.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
AppSpider Plugin 1.0.16 requires POST requests and Overall/Administer permission for the affected form validation method.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| com.rapid7:jenkinsci-appspider-plugin | le | 1.0.15 |
Related
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
0.0005 Low
EPSS
Percentile
17.5%