medium4.3
CVE-2017-1000388
Jenkins Dependency Graph Viewer plugin vulnerable to missing permission checks
Impact
Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency graph, allowing anyone with Overall/Read permission to modify this data.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:depgraph-view | <= 0.12 | 0.13 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Dependency Graph Viewer | through 0.12 |