PT-2022-22346 · Jenkins · Jenkins Recipe Plugin+1

Matt Sicker · Published 2022-06-30 · Updated 2023-11-03 · CVE-2022-34794

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Recipe Plugin versions 1.2 and earlier

Description The issue is related to missing permission checks in the Jenkins Recipe Plugin, allowing attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML. Additionally, the plugin allows users to export the full configuration of jobs as part of a recipe, granting access to job configuration XML data to every user with Item/Read permission. The encrypted values of secrets stored in the job configuration are not redacted, as they would be by the config.xml API for users without Item/Configure permission.

Recommendations For Jenkins Recipe Plugin versions 1.2 and earlier, consider disabling the plugin until a patch is available to prevent attackers from sending HTTP requests to attacker-specified URLs. Restrict access to the plugin's functionality to minimize the risk of exploitation, especially for users with Overall/Read or Item/Read permissions. Avoid using the plugin to export job configurations until the issue is resolved to prevent unauthorized access to sensitive data.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-34794

GHSA-J33R-CGM6-PV48

Affected Products

Jenkins

Jenkins Recipe Plugin

References · 7

• https://jenkins.io/security/advisory/2022-06-30/#SECURITY-2000 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34794 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34794 · Security Note
• https://osv.dev/vulnerability/GHSA-j33r-cgm6-pv48 · Vendor Advisory
• https://github.com/jenkinsci/recipe-plugin · Note
• https://t.me/cibsecurity/45431 · Telegram Post
• https://t.me/cvenotify/60509 · Telegram Post