What is GHSA-vvfj-p4jf-j8rm?

GHSA-vvfj-p4jf-j8rm is a security advisory published by GitHub Security Advisories with Medium severity. Missing permission check in Jenkins Static Analysis Utilities Plugin

Which CVE IDs does GHSA-vvfj-p4jf-j8rm cover?

GHSA-vvfj-p4jf-j8rm covers the following CVE IDs: CVE-2019-10308. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vvfj-p4jf-j8rm?

GHSA-vvfj-p4jf-j8rm has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-vvfj-p4jf-j8rm?

GHSA-vvfj-p4jf-j8rm affects 1 product, including: maven/org.jvnet.hudson.plugins:analysis-core:\u003c= 1.95.

GHSA-vvfj-p4jf-j8rmMediumCVSS 6.5

Missing permission check in Jenkins Static Analysis Utilities Plugin

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

December 14, 2023

🔗 CVE IDs covered (1)

CVE-2019-10308 →

📋 Description

A missing permission check in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers with Overall/Read permission to change the per-job default graph configuration for all users.

🎯 Affected products1

maven/org.jvnet.hudson.plugins:analysis-core:<= 1.95

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2019-10308
https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1100
http://www.openwall.com/lists/oss-security/2019/04/30/5
http://www.securityfocus.com/bid/108159
https://github.com/jenkinsci/analysis-core-plugin/commit/3d7a0c7907d831c58541508b893dcea2039809c5
https://github.com/advisories/GHSA-vvfj-p4jf-j8rm