Access Control Bypass Affecting io.jenkins.plugins:shared-library-version-override package, versions [,19.v3a_c975738d4a_)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-IOJENKINSPLUGINS-8381008
- published 14 Nov 2024
- disclosed 14 Nov 2024
- credit Daniel Beck, CloudBees, Inc.
Introduced: 14 Nov 2024
New CVE-2024-52554 Open this link in a new tabHow to fix?
Upgrade io.jenkins.plugins:shared-library-version-override to version 19.v3a_c975738d4a_ or higher.
Overview
Affected versions of this package are vulnerable to Access Control Bypass which overrides folder-scoped library configuration as trusted so that they’re not executed in the Script Security sandbox.
Note: This is only exploitable for attackers with Item/Configure permission.