netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-h6qv-f5gf-8gcf
GHSA-998m-f2x3-jjq4
This commit is contained in:
advisory-database[bot]
2023-10-27 14:23:57 +00:00
parent 9f9e6f5453
commit 87f168f487
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2021/06/GHSA-h6qv-f5gf-8gcf/GHSA-h6qv-f5gf-8gcf.json
+2 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h6qv-f5gf-8gcf",
"modified": "2022-12-15T18:21:22Z",
"modified": "2023-10-27T14:23:01Z",
"published": "2021-06-16T17:29:35Z",
"aliases": [
"CVE-2021-21654"
],
"summary": "Missing Authorization in Jenkins P4 plugin",
"details": "Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password.\n\nP4 Plugin 1.11.5 requires Overall/Administer for the affected HTTP endpoints.",
"details": "Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password.\n\nJenkins P4 Plugin 1.11.5 requires Overall/Administer for the affected HTTP endpoints.",
"severity": [
{
"type": "CVSS_V3",
advisories/github-reviewed/2022/05/GHSA-998m-f2x3-jjq4/GHSA-998m-f2x3-jjq4.json
+3 -3
View File
@@ -1,17 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-998m-f2x3-jjq4",
"modified": "2022-12-13T19:26:33Z",
"modified": "2023-10-27T14:22:04Z",
"published": "2022-05-24T17:48:05Z",
"aliases": [
"CVE-2021-21644"
],
"summary": "CSRF vulnerability in Jenkins Config File Provider Plugin allows deleting configuration files",
"details": "Config File Provider Plugin 3.7.0 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nThis vulnerability allows attackers to delete configuration files corresponding to an attacker-specified ID.\n\nThis is due to an incomplete fix of [SECURITY-938](https://www.jenkins.io/security/advisory/2018-09-25/#SECURITY-938).\n\nConfig File Provider Plugin 3.7.1 requires POST requests for the affected HTTP endpoint.",
"details": "Jenkins Config File Provider Plugin 3.7.0 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nThis vulnerability allows attackers to delete configuration files corresponding to an attacker-specified ID.\n\nThis is due to an incomplete fix of [SECURITY-938](https://www.jenkins.io/security/advisory/2018-09-25/#SECURITY-938).\n\nJenkins Config File Provider Plugin 3.7.1 requires POST requests for the affected HTTP endpoint.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
}
],
"affected": [