Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.jenkins.plugins:aws-global-configuration

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.3MavenPublished

    Missing permission check in Jenkins AWS Global Configuration Plugin allows replacing plugin configuration

    CVE-2020-2311 · GHSA-7v7g-mh53-89hw

    Affected
    • Maven io.jenkins.plugins:aws-global-configuration <= 1.5
    Fixed in
    1.6· Vendor fix available
    Issue
    Jenkins AWS Global Configuration Plugin 1.5 and earlier does not perform a permission check in an HTTP endpoint processing form submissions. This allows attackers with Overall/Read permission to replace the global AWS configuration. Jenkins AWS Global Configuration Plugin 1.6 properly performs permission checks when processing configuration form submissions.

    Recommended action: Upgrade to 1.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →