Threats tagged 'ghsa-jp9r-mmhw-vff3'

The Jenkins Matrix Authorization Strategy Plugin versions 2.0-beta-1 through 3.2.9 allow unsafe deserialization by invoking parameterless constructors of classes specified in configuration without restricting which classes can be instantiated. This vulnerability can be exploited by attackers with Item/Configure permission to instantiate arbitrary types, potentially leading to information disclosure or other impacts depending on available classes. The issue is fixed in version 3.2.10, which verifies that only inheritance strategy implementations can be instantiated.