https://bugzilla.redhat.com/show_bug.cgi?id=1576706
Bug ID: 1576706
Summary: jenkins: CLI and UI allow non-admin users to enumerate
installed plugins (SECURITY-771)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: ahardin(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, mchappel(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Users with Overall/Read permission were able use the list-plugins CLI command
and view the About Jenkins page to list all installed plugins.
External References:
https://jenkins.io/security/advisory/2018-05-09/
--
You are receiving this mail because:
You are on the CC list for the bug.