GHSA-c445-xm3f-hmfh

GitHub Security Advisory

Incorrect permission check in Health Advisor by CloudBees Plugin

✓ GitHub Reviewed MODERATE Has CVE

Health Advisor by CloudBees Plugin 3.2.0 and earlier does not correctly perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to view an administrative configuration page.

Health Advisor by CloudBees Plugin 3.2.1 requires Overall/Administer to view its administrative configuration page.

Maven org.jenkins-ci.plugins:cloudbees-jenkins-advisor

Affected versions: 0 (fixed in 3.2.1)

CVE-2020-2258

GHSA ID

GHSA-c445-xm3f-hmfh

Published

May 24, 2022 5:28 PM

Last Modified

December 29, 2022 1:35 AM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:cloudbees-jenkins-advisor

GitHub Reviewed

✓ Yes

Last updated: July 3, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.