netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-h246-g39x-7vmx

Browse Source
This commit is contained in:
advisory-database[bot]
2023-10-27 15:30:13 +00:00
parent cf71ac10a5
commit 9b3fb5eab2
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-h246-g39x-7vmx/GHSA-h246-g39x-7vmx.json
+2 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h246-g39x-7vmx",
"modified": "2022-12-14T16:21:59Z",
"modified": "2023-10-27T15:28:59Z",
"published": "2022-05-24T22:01:39Z",
"aliases": [
"CVE-2021-21662"
],
"summary": "Missing permission check in Jenkins XebiaLabs XL Deploy Plugin allows enumerating credentials IDs",
"details": "XebiaLabs XL Deploy Plugin 10.0.1 and earlier does not perform a permission check in a method implementing form validation.\n\nThis allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.\n\nAn enumeration of credentials IDs in XebiaLabs XL Deploy Plugin 10.0.2 requires the appropriate permissions.",
"details": "Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier does not perform a permission check in a method implementing form validation.\n\nThis allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.\n\nAn enumeration of credentials IDs in XebiaLabs XL Deploy Plugin 10.0.2 requires the appropriate permissions.",
"severity": [
{
"type": "CVSS_V3",