PT-2022-20406 · Jenkins · Jenkins Wmi Windows Agents Plugin+1

Kalle Niemitalo · Published 2022-05-17 · Updated 2023-11-03 · CVE-2022-30951

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins WMI Windows Agents Plugin versions 1.8 and earlier

Description The Jenkins WMI Windows Agents Plugin includes the Windows Remote Command library, which does not implement access control. This potentially allows users to start processes even if they are not allowed to log in. The library provides a general-purpose remote command execution capability, which may allow users to execute commands on the Windows agent machine due to a buffer overflow vulnerability.

Recommendations For Jenkins WMI Windows Agents Plugin versions 1.8 and earlier, update to version 1.8.1 or later, which no longer includes the Windows Remote Command library. Ensure a Java runtime is available on agent machines, as version 1.8.1 does not install a JDK automatically.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-30951

GHSA-P566-WPXX-574M

Affected Products

Jenkins

Jenkins Wmi Windows Agents Plugin

References · 9

• https://jenkins.io/security/advisory/2022-05-17/#SECURITY-2604 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p566-wpxx-574m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30951 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30951 · Vendor Advisory
• https://github.com/jenkinsci/windows-slaves-plugin/commit/4638cf0e56caf839eadfdf0fab545abd2a9ac65e · Note
• https://github.com/jenkinsci/windows-slaves-plugin · Note
• http://openwall.com/lists/oss-security/2022/05/17/8 · Note
• https://t.me/cibsecurity/42810 · Telegram Post
• https://t.me/cvenotify/30308 · Telegram Post