CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users to bypass workspace ownership validation on the /build/branch-list endpoint, enabling them to access and enumerate repositories from other workspaces. This could lead to unauthorized information disclosure and potential exploitation of stored credentials through git commands. Organizations using Jpom versions up to 2.11.12 should prioritize patching this issue to safeguard against unauthorized access to sensitive repository information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository existence, determine repository type, and execute git ls-remote commands using other workspaces' stored credentials.