Jenkins Android Signing Plugin allows attackers to check whether attacker-specified file patterns match workspace contents
Moderate severity
GitHub Reviewed
Published
Jul 28, 2022
to the GitHub Advisory Database
•
Updated Jan 3, 2024
Package
Affected versions
<= 2.2.5
Patched versions
None
Description
Published by the National Vulnerability Database
Jul 27, 2022
Published to the GitHub Advisory Database
Jul 28, 2022
Reviewed
Aug 11, 2022
Last updated
Jan 3, 2024
Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation.
This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A sequence of requests can be used to effectively list workspace contents.
References