PT-2022-20410 · Jenkins · Jenkins Git Plugin+1

Kevin Guerroudj · Published 2022-05-17 · Updated 2023-11-03 · CVE-2022-30955

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins GitLab Plugin versions 1.5.31 and earlier

Description The issue allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins due to a missing permission check in an HTTP endpoint.

Recommendations For Jenkins GitLab Plugin versions 1.5.31 and earlier, update to version 1.5.32 or later to ensure that enumeration of credentials IDs requires the appropriate permissions.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-30955

GHSA-5PHJ-QV74-PV4W

Affected Products

Jenkins

Jenkins Git Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-30955 · Security Note
• https://jenkins.io/security/advisory/2022-05-17/#SECURITY-2753 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30955 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5phj-qv74-pv4w · Vendor Advisory
• https://github.com/jenkinsci/gitlab-plugin/commit/37e48ca920a4779109b885f4de62111e0baf846a · Note
• https://github.com/jenkinsci/gitlab-plugin · Note