PT-2022-4020 · Jenkins · Jenkins Compuware Source Code Download For Endevor+1
Published
2022-07-27
·
Updated
2023-11-02
·
CVE-2022-36896
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin versions 2.0.12 and earlier
Description
A missing permission check in the plugin allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins. This could potentially be used as part of an attack to capture the credentials using another vulnerability. The issue is related to insufficient authorization procedures, which can allow a remote attacker to gain unauthorized access to protected information.
Recommendations
For versions 2.0.12 and earlier, update to version 2.0.13 or later, which requires the appropriate permissions to enumerate hosts and ports of Compuware configurations and credentials IDs. As a temporary workaround, consider restricting access to the plugin's HTTP endpoints to minimize the risk of exploitation.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jenkins
Jenkins Compuware Source Code Download For Endevor