GHSA-8h2m-54wh-gwj3

ghsaUSosv

Jenkins docker-build-step Plugin missing permission check

view advisory published 2024-03-06Licence: CC-BY-4.0

A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-2216US	—OT elevated	0.83% (57th)	—	2024-03-06
A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifie…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2024/03/06/3WEB
https://github.com/jenkinsci/docker-build-step-pluginPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2024-2216ADVISORY
https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3200WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan