CVE-2024-28159: Jenkins Subversion Partial Release Manager Plugin missing permission check
Summary
CVE-2024-28159: Jenkins Subversion Partial Release Manager Plugin missing permission check. Affects org.jenkins-ci.plugins:svn-partial-release-mgr versions < 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Subversion Partial Release Manager Plugin is a Maven package that provides functionality for managing partial releases in a Subversion repository. It allows users to trigger builds and perform other actions related to the release process. However, a vulnerability has been discovered in versions 1.0.1 and earlier of the plugin, which could allow attackers with Item/Read permission to trigger a build without proper authorization.
Vulnerability Detail
The vulnerability in the Jenkins Subversion Partial Release Manager Plugin arises from a missing permission check. Attackers with Item/Read permission can exploit this flaw to trigger a build, potentially leading to unauthorized access or other security issues. The impact of this vulnerability is considered moderate, with a CVSS score of 4.3. It is important to note that this vulnerability only affects versions 1.0.1 and earlier of the plugin.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators can revoke Item/Read permission for untrusted users to mitigate the risk of unauthorized build triggering. This can be done through the Jenkins user management interface or by modifying the Jenkins configuration files. However, it is strongly advised to apply the official fix by upgrading to a secure version of the plugin.
Conclusion
The Jenkins Subversion Partial Release Manager Plugin is vulnerable to a missing permission check, allowing attackers with Item/Read permission to trigger unauthorized builds. To mitigate this risk, it is recommended to upgrade to version 1.0.2 or later of the plugin, which includes the necessary permission checks. Administrators can also temporarily revoke Item/Read permission for untrusted users as a workaround. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:svn-partial-release-mgr →
FAQ
The Jenkins Subversion Partial Release Manager Plugin is a Maven package that facilitates the management of partial releases in a Subversion repository. It provides functionality for triggering builds and performing other actions related to the release process.
The vulnerability allows attackers with Item/Read permission to trigger a build without proper authorization. This could potentially lead to unauthorized access or other security issues.
Versions 1.0.1 and earlier of the Jenkins Subversion Partial Release Manager Plugin are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to version 1.0.2 or later of the Jenkins Subversion Partial Release Manager Plugin. This version includes the necessary permission checks to prevent unauthorized build triggering.
As a temporary workaround, administrators can revoke Item/Read permission for untrusted users to mitigate the risk of unauthorized build triggering. However, it is strongly advised to apply the official fix by upgrading to a secure version of the plugin.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:svn-partial-release-mgr.
