medium4.3
CVE-2023-3315
Jenkins Team Concert Plugin does not perform permission checks in methods implementing form validation
Impact
Jenkins Team Concert Plugin 2.4.1 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. Team Concert Plugin 2.4.2 requires Overall/Administer permission for the affected form validation methods.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:teamconcert | < 2.4.2 | 2.4.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Team Concert | through 2.4.1 |