4.3
Medium
CVE-2024-28155 Jenkins AppSpider Plugin 1.0.16 and earlier does not perform permission checks in several HTTP endpoints, allowing…
Description
Jenkins AppSpider Plugin 1.0.16 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about available scan config names, engine group names, and client names.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins AppSpider Plugin 1.0 | earliest → 1.0.16 | No fix stated |
References
- Jenkins Security Advisory 2024-03-06 www.jenkins.io
- www.openwall.com www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Jenkins AppSpider Plugin
The 5 CVEs of Jenkins AppSpider Plugin →
CVE-2026-48923
Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form…
4.3
Medium
CVE-2023-32998
A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to…
8.8
High
CVE-2023-32999
A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read…
4.3
Medium
CVE-2020-2314
Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the…
Not rated