Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission.
Scores
Version
Score
Vecteur
Évalué par
CVSS 3.1
MEDIUM 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD · nvd@nist.gov (Primary)
CVSS 2.0
MEDIUM 4.0
AV:N/AC:L/Au:S/C:N/I:P/A:N
NVD · nvd@nist.gov (Primary)
Avis
GHSA-q4wp-8c99-69pw — Improper permission checks allow canceling queue items and aborting builds in Jenkins
