What is GHSA-mrf6-4gw6-65v3?

GHSA-mrf6-4gw6-65v3 is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins extreme-feedback Plugin vulnerable to Missing Authorization

Which CVE IDs does GHSA-mrf6-4gw6-65v3 cover?

GHSA-mrf6-4gw6-65v3 covers the following CVE IDs: CVE-2022-41242. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mrf6-4gw6-65v3?

GHSA-mrf6-4gw6-65v3 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-mrf6-4gw6-65v3?

GHSA-mrf6-4gw6-65v3 affects 1 product, including: maven/org.jenkins-ci.plugins:extreme-feedback:\u003c= 1.7.

GHSA-mrf6-4gw6-65v3MediumCVSS 5.4

Jenkins extreme-feedback Plugin vulnerable to Missing Authorization

Vendor

GitHub Security Advisories

Published

September 22, 2022

Last Modified

October 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-41242 →

📋 Description

Jenkins extreme-feedback Plugin 1.7 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to discover information about job names attached to lamps, discover MAC and IP addresses of existing lamps, and rename lamps.

As of publication of this advisory, there is no fix.

🎯 Affected products1

maven/org.jenkins-ci.plugins:extreme-feedback:<= 1.7

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2022-41242
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2001
https://github.com/advisories/GHSA-mrf6-4gw6-65v3