Details
-
Bug
-
Status: Done (View Workflow)
-
Minor
-
Resolution: Fixed
Description
The published SECURITY-1995 advisory says:
requests-plugin Plugin 2.2.6 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to view the list of pending requests.
requests-plugin Plugin 2.2.7 requires Overall/Read permission to view the list of pending requests.
This seems to contradict itself. I suspect the second sentence should be:
This allows attackers without Overall/Read permission to view the list of pending requests.
Attachments
Issue Links
- links to
Activity
Kalle Niemitalo
added a comment - The fix is live already. 
kon Thanks for the report!
The sentence you identified is correct, but the fix is not: It now requires Overall/Administer permission to view.
https://github.com/jenkins-infra/jenkins.io/pull/4450 fixes it.