CVE-2024-28155

https://notcve.org/view.php?id=CVE-2024-28155

06 Mar 2024 — Jenkins AppSpider Plugin 1.0.16 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about available scan config names, engine group names, and client names. El complemento Jenkins AppSpider 1.0.16 y versiones anteriores no realiza comprobaciones de permisos en varios endpoints HTTP, lo que permite a los atacantes con permiso general/lectura obtener información sobre los nombres de configuraciones de escaneo disponibl... • http://www.openwall.com/lists/oss-security/2024/03/06/3 • CWE-862: Missing Authorization •