Aller au contenu
Se connecter
6.5 Moyenne

CVE-2026-42521 Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless…

Description

Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.

Produits et versions touchés

Produit Versions touchées Corrigé en
Jenkins Matrix Authorization Strategy Plugin 2.0 2.0-beta-1 → 3.2.9 Pas de correctif indiqué

Autres CVE de Jenkins Matrix Authorization Strategy Plugin

Les 3 CVE de Jenkins Matrix Authorization Strategy Plugin →
CVE-2021-21623 An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with… Non notée CVE-2020-2226 Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration,… Non notée
Suivre cette CVE