Missing permission checks in Google Kubernetes Engine Jenkins Plugin

2022-05-2416:58:49

Google

osv.dev

0.001 Low

EPSS

Percentile

22.0%

JSON

A missing permission check in Jenkins Google Kubernetes Engine Plugin Prior to version 0.7.1 allows attackers with Overall/Read permission to obtain limited information about the scope of a credential with an attacker-specified credentials ID. This issue is patched in version 0.7.1

CPENameOperatorVersion
org.jenkins-ci.plugins:google-kubernetes-engineeq0.6.3
org.jenkins-ci.plugins:google-kubernetes-engineeq0.7.0
org.jenkins-ci.plugins:google-kubernetes-engineeq0.2.0
org.jenkins-ci.plugins:google-kubernetes-engineeq0.5.0
org.jenkins-ci.plugins:google-kubernetes-engineeq0.6.2
org.jenkins-ci.plugins:google-kubernetes-engineeq0.6.0
org.jenkins-ci.plugins:google-kubernetes-engineeq0.4.0
org.jenkins-ci.plugins:google-kubernetes-engineeq0.6.1

Name	Operator	Version
org.jenkins-ci.plugins:google-kubernetes-engine	eq	0.6.3
org.jenkins-ci.plugins:google-kubernetes-engine	eq	0.7.0
org.jenkins-ci.plugins:google-kubernetes-engine	eq	0.2.0
org.jenkins-ci.plugins:google-kubernetes-engine	eq	0.5.0
org.jenkins-ci.plugins:google-kubernetes-engine	eq	0.6.2
org.jenkins-ci.plugins:google-kubernetes-engine	eq	0.6.0
org.jenkins-ci.plugins:google-kubernetes-engine	eq	0.4.0
org.jenkins-ci.plugins:google-kubernetes-engine	eq	0.6.1