Jenkins Global Post Script Plugin missing permission check

2022-05-2416:59:38

Google

osv.dev

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.0%

JSON

Jenkins Global Post Script Plugin does not perform permission checks on a method implementing form validation. This allows users with Overall/Read permission to list the files contained in $JENKINS_HOME/global-post-script that can be used by the plugin.

CPENameOperatorVersion
org.jenkins-ci.plugins:global-post-scripteq1.0.10
org.jenkins-ci.plugins:global-post-scripteq1.1.0
org.jenkins-ci.plugins:global-post-scripteq1.0.12
org.jenkins-ci.plugins:global-post-scripteq1.1.1
org.jenkins-ci.plugins:global-post-scripteq1.1.4
org.jenkins-ci.plugins:global-post-scripteq1.1.3
org.jenkins-ci.plugins:global-post-scripteq1.1.1.1
org.jenkins-ci.plugins:global-post-scripteq1.1.2
org.jenkins-ci.plugins:global-post-scripteq1.0.6
org.jenkins-ci.plugins:global-post-scripteq1.0.9

Name	Operator	Version
org.jenkins-ci.plugins:global-post-script	eq	1.0.10
org.jenkins-ci.plugins:global-post-script	eq	1.1.0
org.jenkins-ci.plugins:global-post-script	eq	1.0.12
org.jenkins-ci.plugins:global-post-script	eq	1.1.1
org.jenkins-ci.plugins:global-post-script	eq	1.1.4
org.jenkins-ci.plugins:global-post-script	eq	1.1.3
org.jenkins-ci.plugins:global-post-script	eq	1.1.1.1
org.jenkins-ci.plugins:global-post-script	eq	1.1.2
org.jenkins-ci.plugins:global-post-script	eq	1.0.6
org.jenkins-ci.plugins:global-post-script	eq	1.0.9