Description
Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository existence, determine repository type, and execute git ls-remote commands using other workspaces' stored credentials.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
dromara Jpom
Default version status: unaffected
0 to ≤ 2.11.12affected
pkg:github/dromara/JpomReferences
- https://github.com/dromara/Jpom/issues/115 ↗
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/build/BuildInfoController.java#L436-L454 ↗
- https://github.com/dromara/Jpom ↗
- https://www.vulncheck.com/advisories/jpom-through-2.11.12-workspace-isolation-bypass-via-build-branch-list ↗