<p>A fix was pushed into the <code>master</code> branch but not yet published.</p>

Improper Authentication Affecting org.jenkins-ci.plugins:cloud-stats package, versions [,0.27)

Snyk CVSS

Attack Complexity High

Threat Intelligence

EPSS 0.05% (21^st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-JAVA-ORGJENKINSCIPLUGINS-1089863
published 31 Mar 2021
disclosed 31 Mar 2021
credit Daniel Beck

Report a new vulnerability Found a mistake?

Introduced: 31 Mar 2021

CVE-2021-21631 Open this link in a new tab CWE-287 Open this link in a new tab

How to fix?

A fix was pushed into the master branch but not yet published.

Overview

org.jenkins-ci.plugins:cloud-stats is an a plugin that collects activities of other plugins and visualizes them as well as provides them to other plugins in form of an API.

Affected versions of this package are vulnerable to Improper Authentication. It does not perform a permission check in an HTTP endpoint.This allows attackers with overall/read permission and knowledge of random activity IDs to view related provisioning exception error messages.