GHSA-436g-2f92-cvhh

Suggest an improvement
Source
https://github.com/advisories/GHSA-436g-2f92-cvhh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-436g-2f92-cvhh/GHSA-436g-2f92-cvhh.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-436g-2f92-cvhh
Aliases
Published
2023-04-02T21:30:17Z
Modified
2024-12-06T05:44:06.387533Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Jenkins Role-based Authorization Strategy Plugin grants permissions even after they’ve been disabled
Details

Permissions in Jenkins can be enabled and disabled. Some permissions are disabled by default, e.g., Overall/Manage or Item/Extended Read. Disabled permissions cannot be granted directly, only through greater permissions that imply them (e.g., Overall/Administer or Item/Configure).

Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they’ve been disabled.

This allows attackers to have greater access than they’re entitled to after the following operations took place:

A permission is granted to attackers directly or through groups.

The permission is disabled, e.g., through the script console.

Role-based Authorization Strategy Plugin 587.588.v850a20a30162 does not grant disabled permissions.

Database specific
{
    "nvd_published_at": "2023-04-02T21:15:00Z",
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-03T22:55:17Z"
}
References

Affected packages

Maven / org.jenkins-ci.plugins:role-strategy

Package

Name
org.jenkins-ci.plugins:role-strategy
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/role-strategy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
587.588.v850a_20a_30162

Affected versions

1.*

1.1.2
1.1.3

2.*

2.1.0
2.2.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.6.0
2.6.1
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.10
2.11
2.12
2.13
2.14
2.15
2.16

3.*

3.0
3.1
3.1.1
3.2.0

483.*

483.v17281966f5c3

484.*

484.v8a_a_e4b_d785fd

488.*

488.v0634ce149b_8c

501.*

501.v88fe53d65c80

506.*

506.v13f908ee1fc9

508.*

508.v2a_f05b_05e9d8

510.*

510.v909834359ec2

521.*

521.vcf7a_3a_8dde42

526.*

526.v859673312a_14

530.*

530.ved5445d4875a_

546.*

546.ve16648865996

548.*

548.vb_60076577ec7

552.*

552.v14cb_85499b_89

555.*

555.v8d194cc85b_30

561.*

561.v9846c7351a_41

562.*

562.v44e9a_e828d0e

569.*

569.v7476f8e4fe29

575.*

575.v4d286a_03e6d7

584.*

584.vf8e515397ecd

587.*

587.v2872c41fa_e51

Database specific

{
    "last_known_affected_version_range": "< 587.588.v850a"
}