medium4.3
CVE-2023-30522
Jenkins Fogbugz Plugin has missing permissions check
Impact
Jenkins Fogbugz Plugin provides a webhook endpoint at `/fbTrigger/` that can be used to trigger builds of any jobs. In Fogbugz Plugin 2.2.17 and earlier, this endpoint can be accessed by attackers with Item/Read permission, allowing them to trigger builds of jobs specified in a `jobname` request parameter.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:fogbugz | <= 2.2.17 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Fogbugz | through 2.2.17 |