description: Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to trigger jobs that are configured to be triggerable via Rundeck.
affected:
{
product: Jenkins Rundeck Plugin
vendor: Jenkins project
versions:
lessThanOrEqual: 3.6.11, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: unknown, version: next of 3.6.11, versionType: custom
}