PT-2022-4016 · Jenkins · Jenkins Coverity Plugin+1

Kevin Guerroudj · Published 2022-07-27 · Updated 2023-11-02 · CVE-2022-36919

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Coverity Plugin versions 1.11.4 and earlier

Description A missing permission check in the Jenkins Coverity Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. This issue is related to insufficient authorization procedures, which can be exploited by a remote attacker to gain unauthorized access to protected information. The vulnerability can be used as part of an attack to capture credentials using another vulnerability.

Recommendations For Jenkins Coverity Plugin versions 1.11.4 and earlier, as a temporary workaround, consider restricting access to the plugin until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2022-04849

CVE-2022-36919

GHSA-X7W4-VFRH-FC3H

Affected Products

Jenkins

Jenkins Coverity Plugin

References · 8

• https://jenkins.io/security/advisory/2022-07-27/#SECURITY-2790%20%281%29 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04849 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-36919 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36919 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x7w4-vfrh-fc3h · Vendor Advisory
• http://openwall.com/lists/oss-security/2022/07/27/1 · Note
• https://jenkins.io/security/advisory/2022-07-27/#SECURITY-2790%20(1) · Note
• https://t.me/cibsecurity/47085 · Telegram Post