Loading HuntDB...

GHSA-vc7g-4269-f7hw

GitHub Security Advisory

Missing permission check in Blue Ocean Plugin

✓ GitHub Reviewed MODERATE Has CVE

Advisory Details

### Updated 2020-09-16
This entry previously misidentified the problematic behavior. The HTTP request itself is legitimate, but only authorized users should be able to perform it.

### Original Description
Blue Ocean Plugin 1.23.2 and earlier does not perform permission checks in several HTTP endpoints implementing connection tests.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Blue Ocean Plugin 1.23.3 requires Item/Create permission to perform these connection tests.

Affected Packages

Maven io.jenkins.blueocean:blueocean
Affected versions: 0 (fixed in 1.23.3)

Related CVEs

Key Information

GHSA ID
GHSA-vc7g-4269-f7hw
Published
May 24, 2022 5:28 PM
Last Modified
December 29, 2022 1:31 AM
CVSS Score
5.0 /10
Primary Ecosystem
Maven
Primary Package
io.jenkins.blueocean:blueocean
GitHub Reviewed
✓ Yes

Dataset

Last updated: July 5, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.