medium4.3
CVE-2020-2198
Missing permission check in Jenkins Project Inheritance Plugin
Impact
Jenkins Project Inheritance Plugin 21.04.03 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting job config.xml data to users without Job/Configure.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | hudson.plugins:project-inheritance | <= 21.04.03 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Project Inheritance | through 19.08.02 |