CVE-2022-34180

First published: Wed Jun 22 2022(Updated: )

Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for \"unprotected\" status badge access. This allows attackers without any permissions to obtain the build status badge icon for any attacker-specified job and/or build. Embeddable Build Status Plugin 2.0.4 requires ViewStatus permission to obtain the build status badge icon.

Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/github-advisory-latest
• alias/GHSA-xxhf-xq6v-c8mj
• alias/CVE-2022-34180
• collector/nvd-index
• collector/nvd-cve
• collector/nvd-api
• agent/author
• agent/type
• agent/event
• agent/last-modified-date
• agent/first-publish-date
• agent/weakness
• agent/references
• agent/severity
• agent/softwarecombine
• agent/description
• agent/tags
• collector/mitre-cve
• source/MITRE
• package-manager/maven
• vendor/jenkins
• canonical/jenkins embeddable build status
• version/jenkins embeddable build status/2.0.3