Loading HuntDB...

GHSA-74x9-fhc2-p79f

GitHub Security Advisory

Missing permission checks in Jenkins CONS3RT Plugin allow capturing credentials

✓ GitHub Reviewed MODERATE Has CVE

Advisory Details

CONS3RT Plugin 1.0.0 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Affected Packages

Maven org.jenkins-ci.plugins:cons3rt
Affected versions: 0 (last affected: 1.0.0)

Related CVEs

Key Information

GHSA ID
GHSA-74x9-fhc2-p79f
Published
September 22, 2022 12:00 AM
Last Modified
December 6, 2022 12:41 AM
CVSS Score
5.0 /10
Primary Ecosystem
Maven
Primary Package
org.jenkins-ci.plugins:cons3rt
GitHub Reviewed
✓ Yes

Dataset

Last updated: July 5, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.