GHSA-9mc6-vgmq-x6xf
GitHub Security Advisory
Lack of authentication mechanism in Jenkins DotCi Plugin webhook
✓ GitHub Reviewed
MODERATE
Has CVE
Advisory Details
DotCi Plugin provides a webhook endpoint at `/githook/` that can be used to trigger builds of the job for a GitHub repository.
In DotCi Plugin 2.40.00 and earlier, this endpoint can be accessed without authentication.
This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits.
This plugin has been suspended.
Affected Packages
Maven
com.groupon.jenkins-ci.plugins:DotCi
Affected versions:
0
(last affected: 2.40.00)
Related CVEs
Key Information
5.0
/10
Dataset
Last updated: August 24, 2025 6:28 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.