PT-2022-14826 · Jenkins · Jenkins Bitbucket Branch Source Plugin+1

Daniel Beck · Published 2022-01-12 · Updated 2023-11-30 · CVE-2022-20618

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket Branch Source Plugin versions 737.vdf9dc06105be and earlier Jenkins Bitbucket Branch Source Plugin versions prior to 746.v350d2781c184 Jenkins Bitbucket Branch Source Plugin versions prior to 725.vd9f8be0fa250 Jenkins Bitbucket Branch Source Plugin version 2.9.11.2 Jenkins Bitbucket Branch Source Plugin version 2.9.7.2

Description A missing permission check in the Jenkins Bitbucket Branch Source Plugin allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins. This can be used as part of an attack to capture the credentials using another vulnerability. The issue is related to several HTTP endpoints that do not perform permission checks.

Recommendations For Jenkins Bitbucket Branch Source Plugin version 737.vdf9dc06105be and earlier, update to a version later than 746.v350d2781c184. For Jenkins Bitbucket Branch Source Plugin version 2.9.11.2, update to a version later than 2.9.11.2. For Jenkins Bitbucket Branch Source Plugin version 2.9.7.2, update to a version later than 2.9.7.2. As a temporary workaround, consider restricting access to the HTTP endpoints that do not perform permission checks until a patch is available. Restrict access to the credentials stored in Jenkins to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

Incorrect Permission

Weakness Enumeration

CWE-862

CWE-732

Related Identifiers

CVE-2022-20618

GHSA-W2MH-6XJ5-F77F

Affected Products

Jenkins

Jenkins Bitbucket Branch Source Plugin

References · 13

• 🔥 https://github.com/CVEProject/cvelist/blob/2d78eb36f4d084db7fb35f1535d8d84fdcb7d859/2022/20xxx/CVE-2022-20618.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-20618 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20618 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-01-12/#SECURITY-2033 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w2mh-6xj5-f77f · Vendor Advisory
• https://github.com/jenkinsci/bitbucket-branch-source-plugin/commit/467ed6c94af8735c4755d53145a54325ae82d073 · Note
• https://github.com/jenkinsci/bitbucket-branch-source-plugin · Note
• https://t.me/cibsecurity/35364 · Telegram Post
• https://t.me/cvenotify/25358 · Telegram Post
• https://t.me/cvenotify/61749 · Telegram Post
• http://openwall.com/lists/oss-security/2022/01/12/6 · Note
• https://t.me/cvenotify/25718 · Telegram Post
• https://t.me/cvenotify/25327 · Telegram Post