PT-2022-14825 · Jenkins · Jenkins Credentials Binding Plugin+1

Published 2022-01-12 · Updated 2023-11-22 · CVE-2022-20616

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Credentials Binding Plugin versions 1.27 and earlier Jenkins Credentials Binding Plugin versions prior to 1.27.1 Jenkins Credentials Binding Plugin versions prior to 1.24.1

Description The issue allows attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file, due to a lack of permission check in a method implementing form validation.

Recommendations For Jenkins Credentials Binding Plugin versions 1.27 and earlier, update to version 1.27.1 or later. For Jenkins Credentials Binding Plugin versions prior to 1.24.1, update to version 1.24.1 or later. As a temporary workaround, consider restricting access to the form validation method until a patch is available.

Exploit

Fix

Missing Authorization

Incorrect Permission

Weakness Enumeration

CWE-862

CWE-732

Related Identifiers

CVE-2022-20616

GHSA-GQM2-2GCX-P88W

Affected Products

Jenkins

Jenkins Credentials Binding Plugin

References · 11

• 🔥 https://github.com/CVEProject/cvelist/blob/2d78eb36f4d084db7fb35f1535d8d84fdcb7d859/2022/20xxx/CVE-2022-20616.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-20616 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20616 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gqm2-2gcx-p88w · Vendor Advisory
• https://jenkins.io/security/advisory/2022-01-12/#SECURITY-2342 · Vendor Advisory
• https://github.com/jenkinsci/credentials-binding-plugin · Note
• https://github.com/jenkinsci/credentials-binding-plugin/commit/2dd5eda721e52d9a5bf6748405adf965ba517d8a · Note
• https://t.me/cvenotify/25360 · Telegram Post
• http://openwall.com/lists/oss-security/2022/01/12/6 · Note
• https://t.me/cvenotify/25329 · Telegram Post
• https://t.me/cvenotify/25575 · Telegram Post