PT-2022-22348 · Jenkins · Jenkins Deployment Dashboard Plugin+1

Kevin Guerroudj · Published 2022-06-30 · Updated 2023-11-22 · CVE-2022-34796

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Deployment Dashboard Plugin versions 1.0.10 and earlier

Description A missing permission check in the plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. This issue affects several HTTP endpoints, which do not perform permission checks. The enumerated credentials IDs can be used as part of an attack to capture the credentials using another vulnerability.

Recommendations For Jenkins Deployment Dashboard Plugin versions 1.0.10 and earlier, as a temporary workaround, consider restricting access to the affected HTTP endpoints until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Insufficiently Protected Credentials

Weakness Enumeration

CWE-862

CWE-522

Related Identifiers

CVE-2022-34796

GHSA-5MXG-P5QH-2GCH

Affected Products

Jenkins

Jenkins Deployment Dashboard Plugin

References · 6

• https://osv.dev/vulnerability/CVE-2022-34796 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34796 · Security Note
• https://jenkins.io/security/advisory/2022-06-30/#SECURITY-2798%20%281%29 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5mxg-p5qh-2gch · Vendor Advisory
• https://github.com/jenkinsci/ec2-deployment-dashboard · Note
• https://jenkins.io/security/advisory/2022-06-30/#SECURITY-2798%20(1) · Note