PT-2022-18846 · Unknown+1 · Toad Edge Plugin+1

Kevin Guerroudj · Published 2022-03-29 · Updated 2023-11-17 · CVE-2022-28147

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Continuous Integration with Toad Edge Plugin versions 2.3 and earlier

Description A missing permission check allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

Recommendations For versions 2.3 and earlier, update to a version that includes the missing permission check to prevent attackers from checking the existence of arbitrary file paths on the Jenkins controller file system. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Improper Preservation of Permissions

Weakness Enumeration

CWE-862

CWE-281

Related Identifiers

CVE-2022-28147

GHSA-8HH2-RXM8-7FJ8

Affected Products

Jenkins

Toad Edge Plugin

References · 8

• https://jenkins.io/security/advisory/2022-03-29/#SECURITY-2635 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28147 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28147 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8hh2-rxm8-7fj8 · Vendor Advisory
• https://github.com/jenkinsci/ci-with-toad-edge-plugin · Note
• https://github.com/jenkinsci/ci-with-toad-edge-plugin/commit/2b65d62ebb71ec727097aa409c623f9c7c3b2792 · Note
• https://t.me/cibsecurity/39740 · Telegram Post
• http://openwall.com/lists/oss-security/2022/03/29/1 · Note