GHSA-78fg-pvgg-6g3r
GitHub Security Advisory
Missing permission check in Jenkins OpenShift Deployer Plugin
✓ GitHub Reviewed
MODERATE
Has CVE
Advisory Details
OpenShift Deployer Plugin 1.2.0 and earlier does not perform permission checks in methods implementing form validation.
This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system and to upload a SSH key file from the Jenkins controller file system to an attacker-specified URL.
Affected Packages
Maven
org.jenkins-ci.plugins:openshift-deployer
Affected versions:
0
(last affected: 1.2.0)
Related CVEs
Key Information
5.0
/10
Dataset
Last updated: July 3, 2025 6:26 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.