PT-2022-17133 · Jenkins · Jenkins Snow Commander Plugin+1

Daniel Beck · Published 2022-02-15 · Updated 2023-11-03 · CVE-2022-25193

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Snow Commander Plugin versions 1.10 and earlier

Description The issue concerns missing permission checks in the Jenkins Snow Commander Plugin, allowing attackers with Overall/Read permission to connect to a specified webserver using specified credentials IDs. This can lead to the capture of credentials stored in Jenkins. Additionally, form validation methods in the plugin are vulnerable to cross-site request forgery (CSRF) as they do not require POST requests.

Recommendations For Jenkins Snow Commander Plugin versions 1.10 and earlier, consider disabling the plugin until a patch is available to prevent attackers from exploiting the missing permission checks and CSRF vulnerability. Restrict access to the plugin's form validation methods to minimize the risk of exploitation. Avoid using the plugin to connect to external webservices until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-25193

GHSA-2PHQ-GHF8-6586

Affected Products

Jenkins

Jenkins Snow Commander Plugin

References · 5

• https://osv.dev/vulnerability/GHSA-2phq-ghf8-6586 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25193 · Security Note
• https://jenkins.io/security/advisory/2022-02-15/#SECURITY-2536 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25193 · Vendor Advisory
• https://github.com/jenkinsci/snowsoftware-commander-plugin · Note