A missing permission check in Jenkins iceScrum Plugin prior to version 1.1.6 allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. This issue is patched in version 1.1.6

Affected Packages

Maven org.jenkins-ci.plugins:icescrum

Affected versions: 0 (fixed in 1.1.6)

Related CVEs

CVE-2019-10442

Key Information

GHSA ID

GHSA-h5cx-w235-58hm

Published

May 24, 2022 4:58 PM

Last Modified

December 6, 2022 9:51 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:icescrum

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 6, 2025 6:30 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.