PT-2022-22363 · Jenkins · Jenkins Xpath Configuration Viewer Plugin+1

S0Nnguy3N + 1 · Published 2022-06-30 · Updated 2023-11-22 · CVE-2022-34811

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins XPath Configuration Viewer Plugin versions 1.1.1 and earlier

Description A missing permission check in the Jenkins XPath Configuration Viewer Plugin allows attackers with Overall/Read permission to access the XPath Configuration Viewer page. This page grants access to job configuration XML data to every user with Item/Read permission. The encrypted values of secrets stored in the job configuration are not redacted, as they would be by the config.xml API for users without Item/Configure permission.

Recommendations For Jenkins XPath Configuration Viewer Plugin versions 1.1.1 and earlier, consider disabling access to the XPath Configuration Viewer page until a patch is available. Restrict access to the HTTP endpoint related to the XPath Configuration Viewer page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-34811

GHSA-QM37-C4W6-H9V9

Affected Products

Jenkins

Jenkins Xpath Configuration Viewer Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-34811 · Security Note
• https://osv.dev/vulnerability/GHSA-qm37-c4w6-h9v9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34811 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-06-30/#SECURITY-2002 · Vendor Advisory
• https://t.me/cibsecurity/45457 · Telegram Post