PT-2022-4022 · Jenkins · Jenkins Coverity Plugin+1

Published 2022-07-27 · Updated 2023-11-02 · CVE-2022-36921

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Coverity Plugin versions 1.11.4 and earlier

Description The issue is related to a missing permission check in the Jenkins Coverity Plugin, which can be exploited by attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs. This allows the capture of credentials stored in Jenkins. The vulnerability is associated with weaknesses in the authorization procedure.

Recommendations For Jenkins Coverity Plugin versions 1.11.4 and earlier, consider disabling the plugin until a patch is available to prevent attackers from exploiting the missing permission check and capturing credentials. Restrict access to the HTTP endpoint to minimize the risk of exploitation. Avoid using attacker-specified credentials IDs in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2022-04855

CVE-2022-36921

GHSA-99MQ-HW5M-GWJJ

Affected Products

Jenkins

Jenkins Coverity Plugin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-36921 · Security Note
• https://bdu.fstec.ru/vul/2022-04855 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36921 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-07-27/#SECURITY-2790%20%282%29 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-99mq-hw5m-gwjj · Vendor Advisory
• https://github.com/jenkinsci/coverity-plugin · Note
• https://t.me/cibsecurity/47107 · Telegram Post
• https://jenkins.io/security/advisory/2022-07-27/#SECURITY-2790%20(2) · Note
• http://openwall.com/lists/oss-security/2022/07/27/1 · Note