[org.jenkins-ci.plugins:support-core] Incorrect permission checks in Jenkins Support Core Plugin

Support Core Plugin defines the permission Support/DownloadBundle that allows users without Overall/Administer permission to create and download support bundles containing a limited set of diagnostic information.

Support Core Plugin 1206.v14049fa_b_d860 and earlier does not correctly perform permission checks in several HTTP endpoints.

This allows attackers with Support/DownloadBundle permission to download a previously created support bundle containing information limited to users with Overall/Administer permission.

Support Core Plugin 1206.1208.v9b_7a_1d48db_0f deprecates the Support/DownloadBundle permission. The Overall/Administer permission is now required to download support bundles.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-45383
• https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2804
• https://github.com/advisories/GHSA-w2j3-pq63-339w