Maven package
org.jenkins-ci.plugins/role-strategy
pkg:maven/org.jenkins-ci.plugins/role-strategy
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-28668 | — | < 587.588.v850a_20a_30162 | 587.588.v850a_20a_30162 | Mar 23, 2023 | Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled. | ||
| CVE-2021-21624 | — | < 3.1.1 | 3.1.1 | Mar 18, 2021 | An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders. | ||
| CVE-2020-2286 | — | >= 2.12, < 3.1 | 3.1 | Oct 8, 2020 | Jenkins Role-based Authorization Strategy Plugin 3.0 and earlier does not properly invalidate a permission cache when the configuration is changed, resulting in permissions being granted based on an outdated configuration. | ||
| CVE-2017-1000090 | Hig | 8.8 | < 2.5.1 | 2.5.1 | Oct 5, 2017 | Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing le |
- CVE-2023-28668Mar 23, 2023affected < 587.588.v850a_20a_30162fixed 587.588.v850a_20a_30162
Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled.
- CVE-2021-21624Mar 18, 2021affected < 3.1.1fixed 3.1.1
An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.
- CVE-2020-2286Oct 8, 2020affected >= 2.12, < 3.1fixed 3.1
Jenkins Role-based Authorization Strategy Plugin 3.0 and earlier does not properly invalidate a permission cache when the configuration is changed, resulting in permissions being granted based on an outdated configuration.
- affected < 2.5.1fixed 2.5.1
Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing le