Jenkins docker-build-step Plugin missing permission check

2024-03-0618:30:39

Google

osv.dev

jenkins

docker-build-step

plugin

missing permission check

http endpoint

overall/read permission

attackers

connect

reconfigure

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions.

CPENameOperatorVersion
org.jenkins-ci.plugins:docker-build-stepeq2.6
org.jenkins-ci.plugins:docker-build-stepeq1.25
org.jenkins-ci.plugins:docker-build-stepeq2.9
org.jenkins-ci.plugins:docker-build-stepeq1.13
org.jenkins-ci.plugins:docker-build-stepeq1.22
org.jenkins-ci.plugins:docker-build-stepeq1.20
org.jenkins-ci.plugins:docker-build-stepeq1.41
org.jenkins-ci.plugins:docker-build-stepeq1.12
org.jenkins-ci.plugins:docker-build-stepeq1.38
org.jenkins-ci.plugins:docker-build-stepeq1.30

Name	Operator	Version
org.jenkins-ci.plugins:docker-build-step	eq	2.6
org.jenkins-ci.plugins:docker-build-step	eq	1.25
org.jenkins-ci.plugins:docker-build-step	eq	2.9
org.jenkins-ci.plugins:docker-build-step	eq	1.13
org.jenkins-ci.plugins:docker-build-step	eq	1.22
org.jenkins-ci.plugins:docker-build-step	eq	1.20
org.jenkins-ci.plugins:docker-build-step	eq	1.41
org.jenkins-ci.plugins:docker-build-step	eq	1.12
org.jenkins-ci.plugins:docker-build-step	eq	1.38
org.jenkins-ci.plugins:docker-build-step	eq	1.30