Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

GHSA-hj32-9mcw-5cwh

GitHub Security Advisory

Missing permission check in Jenkins Project Inheritance Plugin

✓ GitHub Reviewed MODERATE Has CVE
View on GitHub

Advisory Details

Jenkins limits access to job configuration XML data (`config.xml`) to users with Job/ExtendedRead permission, typically implied by Job/Configure permission. Project Inheritance Plugin has several job inspection features, including the API URL `/job/…​/getConfigAsXML` for its Inheritance Project job type that does something similar.

Project Inheritance Plugin 21.04.03 and earlier does not check permissions for this new endpoint, granting access to job configuration XML data to every user with Job/Read permission.

Additionally, the encrypted values of secrets stored in the job configuration are not redacted, as they would be by the `config.xml` API for users without Job/Configure permission.

Affected Packages

Maven hudson.plugins:project-inheritance
Affected versions: 0 (last affected: 21.04.03)

Related CVEs

CVE-2020-2197

Key Information

GHSA ID
GHSA-hj32-9mcw-5cwh
Published
May 24, 2022 5:19 PM
Last Modified
October 26, 2023 10:24 PM
CVSS Score
5.0 /10
Primary Ecosystem
Maven
Primary Package
hudson.plugins:project-inheritance
GitHub Reviewed
✓ Yes

Dataset

Last updated: July 4, 2025 6:27 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.