medium5.3
CVE-2013-6373
Jenkins Exclusion Plugin allows Access to Resource Locks
Impact
The Exclusion plugin before 0.9 for Jenkins does not properly prevent access to resource locks, which allows remote authenticated users to list and release resources via unspecified vectors.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:exclusion | < 0.9 | 0.9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins-Ci | Exclusion | through 0.8 Versions 0.6, 0.7 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://wiki.jenkins-ci.org/display/JENKINS/Exclusion-Plugin
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-11-20
- https://github.com/advisories/GHSA-2q8v-439j-6p77
- https://nvd.nist.gov/vuln/detail/CVE-2013-6373
- https://github.com/jenkinsci/exclusion-plugin/commit/847f9aeb407c0f47046d184080c9e2c2e3720311