Headline
GHSA-xxv9-w5hm-328j: Jenkins AppSpider Plugin missing permission checks
Jenkins AppSpider Plugin 1.0.16 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about available scan config names, engine group names, and client names.
Jenkins AppSpider Plugin missing permission checks
Moderate severity GitHub Reviewed Published Mar 6, 2024 to the GitHub Advisory Database • Updated Mar 6, 2024