A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins.
CVSS Score
4.3
EPSS Score
0.0
Published
2019-08-07