GHSA-5293-3fgp-cr3x

    Dashboard / Vulnerabilities / GHSA-5293-3fgp-cr3x

    GHSA-5293-3fgp-cr3x

    Published: 13 May 2022Last Modified: 18 Feb 2024

    Summary: Missing permission checks in Jenkins Periodic Backup Plugin allow every user to change settings

    Details: The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks.

    References: https://nvd.nist.gov/vuln/detail/CVE-2017-1000086, https://jenkins.io/security/advisory/2017-07-10, http://www.securityfocus.com/bid/100437

    Affected packages

    Package

    Name: org.jenkins-ci.plugins:periodicbackup

    Purl: pkg:maven/org.jenkins-ci.plugins/periodicbackup

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.5

    Affected versions

    1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-5293-3fgp-cr3x | CVE-DB