MEDIUM 4.3 Maven
Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths
GHSA-p334-gfhq-c7w6 · CVE-2026-42519
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Jenkins Script Security Plugin versions 1399.ve6a_66547f6e1 and earlier do not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
Script Security Plugin 1402.v94c9ce464861 requires Overall/Administer permission to enumerate pending and approved Script Security classpaths.
Ready to move
Start Securing
Free, no credit card | First findings in minutes