GHSA-798p-53r7-mgw9MediumCVSS 6.5

Jenkins HipChat Plugin allows attackers with Overall/Read access to obtain credential IDs

Published
May 13, 2022
Last Modified
February 2, 2023

🔗 CVE IDs covered (1)

CVE-2018-1000419 →

📋 Description

An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins. As of version 2.2.1, an enumeration of credentials IDs in this plugin requires Overall/Administer permission.

🎯 Affected products1

  • maven/org.jvnet.hudson.plugins:hipchat:< 2.2.1

🔗 References (4)