What is GHSA-crvq-mw2w-4cfx?

GHSA-crvq-mw2w-4cfx is a security advisory published by GitHub Security Advisories with High severity. Jenkins Black Duck Hub Plugin allowed any user with Overall/Read to read and write its configuration

Which CVE IDs does GHSA-crvq-mw2w-4cfx cover?

GHSA-crvq-mw2w-4cfx covers the following CVE IDs: CVE-2018-1000197. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-crvq-mw2w-4cfx?

GHSA-crvq-mw2w-4cfx has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-crvq-mw2w-4cfx?

GHSA-crvq-mw2w-4cfx affects 1 product, including: maven/com.blackducksoftware.integration:blackduck-hub:\u003c= 3.0.3.

GHSA-crvq-mw2w-4cfxHighCVSS 8.1

Jenkins Black Duck Hub Plugin allowed any user with Overall/Read to read and write its configuration

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

January 30, 2024

🔗 CVE IDs covered (1)

CVE-2018-1000197 →

📋 Description

An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows users with Overall/Read permission to read and write the Black Duck Hub plugin configuration.

🎯 Affected products1

maven/com.blackducksoftware.integration:blackduck-hub:<= 3.0.3

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000197
https://jenkins.io/security/advisory/2018-05-09/#SECURITY-670
https://github.com/advisories/GHSA-crvq-mw2w-4cfx