diff --git a/advisories/github-reviewed/2022/07/GHSA-m8w5-vwq3-gp8f/GHSA-m8w5-vwq3-gp8f.json b/advisories/github-reviewed/2022/07/GHSA-m8w5-vwq3-gp8f/GHSA-m8w5-vwq3-gp8f.json index c20f1486666..ed8b06265fb 100644 --- a/advisories/github-reviewed/2022/07/GHSA-m8w5-vwq3-gp8f/GHSA-m8w5-vwq3-gp8f.json +++ b/advisories/github-reviewed/2022/07/GHSA-m8w5-vwq3-gp8f/GHSA-m8w5-vwq3-gp8f.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-m8w5-vwq3-gp8f", - "modified": "2023-10-27T20:50:07Z", + "modified": "2024-01-03T13:59:13Z", "published": "2022-07-28T00:00:42Z", "aliases": [ "CVE-2022-36910" ], "summary": "Lucene-Search Plugin does not perform permission checks in several HTTP endpoints", - "details": "Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform permission checks in several HTTP endpoints.\n\nThis allows attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them.\n\nAs of publication of this advisory, there is no fix.", + "details": "Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform permission checks in several HTTP endpoints.\n\nThis allows attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them.\n", "severity": [ { "type": "CVSS_V3", @@ -28,11 +28,14 @@ "introduced": "0" }, { - "last_affected": "370.v62a5f618cd3a" + "fixed": "387.v938a" } ] } - ] + ], + "database_specific": { + "last_known_affected_version_range": "<= 370.v62a5f618cd3a" + } } ], "references": [ @@ -40,6 +43,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36910" }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/lucene-search-plugin/commit/b56e0aba81a355356d20824e81038e9720bc7e2e" + }, { "type": "WEB", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2048"