high8.8
CVE-2023-41939
Disabled permissions can be granted by Jenkins SSH2 Easy Plugin
Impact
Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (typically optional permissions, like Overall/Manage) to access functionality they're no longer entitled to.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:ssh2easy | < 1.6 | 1.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Ssh2 Easy | through 1.4 |