Jenkins AppSpider Plugin 1.0.16 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about available scan config names, engine group names, and client names.

Affected Packages

Maven com.rapid7:jenkinsci-appspider-plugin

Affected versions: 0 (fixed in 1.0.17)

Related CVEs

CVE-2024-28155

Key Information

GHSA ID

GHSA-xxv9-w5hm-328j

Published

March 6, 2024 6:30 PM

Last Modified

May 2, 2024 2:04 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

com.rapid7:jenkinsci-appspider-plugin

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.