medium5.3
CVE-2022-43421
Jenkins Tuleap Git Branch Source Plugin allows unauthenticated attackers to trigger Tuleap projects whose configured repo matches attacker-specified value
Impact
A missing permission check in Jenkins Tuleap Git Branch Source Plugin 3.2.4 and earlier allows unauthenticated attackers to trigger Tuleap projects whose configured repository matches the attacker-specified value. Tuleap Git Branch Source Plugin 3.2.5 requires a token to access the webhook endpoint.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:tuleap-git-branch-source | <= 3.2.4 | 3.2.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Tuleap Git Branch Source | before 3.2.5 |