{"id":"CVE-2018-1000197","aliases":["GHSA-crvq-mw2w-4cfx"],"url":"https://o3.security/vulnerability/CVE-2018-1000197","summary":"Jenkins Black Duck Hub Plugin allowed any user with Overall/Read to read and write its configuration","details":"An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows users with Overall/Read permission to read and write the Black Duck Hub plugin configuration.","published":"2018-06-05T21:29:00.713Z","modified":"2026-09-06T14:04:05.034243Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"epss":{"score":0.00837,"percentile":0.56052,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"com.blackducksoftware.integration:blackduck-hub","fixedVersion":"3.1.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://jenkins.io/security/advisory/2018-05-09/#SECURITY-670"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-06T14:04:05.034243Z"}}