CVE-2018-1000197: Jenkins Black Duck Hub

High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days.

An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows users with Overall/Read permission to read and write the Black Duck Hub plugin configuration.

Affected products

• Jenkins Black Duck Hub: up to and including 3.0.3

Published 2018-06-05. Last modified 2026-06-17.