PT-2022-17130 · Jenkins · Jenkins Conjur Secrets Plugin+1

Published 2022-02-15 · Updated 2023-11-30 · CVE-2022-25190

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Conjur Secrets Plugin versions 1.0.11 and earlier

Description A missing permission check in the plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. This can be done through an HTTP endpoint, and the enumerated credentials IDs can be used as part of an attack to capture the credentials using another vulnerability.

Recommendations For Jenkins Conjur Secrets Plugin versions 1.0.11 and earlier, consider updating to a version that includes the necessary permission checks to prevent credentials ID enumeration. As a temporary workaround, restrict access to the HTTP endpoint responsible for credentials ID enumeration to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-25190

GHSA-372F-JC47-7GR5

Affected Products

Jenkins

Jenkins Conjur Secrets Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-25190 · Security Note
• https://jenkins.io/security/advisory/2022-02-15/#SECURITY-2350 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-372f-jc47-7gr5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25190 · Vendor Advisory
• https://github.com/jenkinsci/conjur-credentials-plugin · Note
• https://github.com/jenkinsci/conjur-credentials-plugin/commit/eda06cde26cdf2d40ae4e2f4d2709e8174489068 · Note
• https://t.me/cvenotify/26818 · Telegram Post