PT-2022-4034 · Compuware+2 · Jenkins Compuware Ispw Operations Plugin+2
Daniel Beck
·
Published
2022-07-27
·
Updated
2023-11-02
·
CVE-2022-36898
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Jenkins Compuware ISPW Operations Plugin versions 1.0.8 and earlier
Jenkins BMC AMI DevX Code Pipeline Operations Plugin versions 1.0.8 and earlier
Description
A missing permission check in the plugin allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins. This could potentially be used as part of an attack to capture the credentials using another vulnerability. The issue is related to insufficient authorization procedures, which can allow a remote attacker to gain unauthorized access to protected information.
Recommendations
For Jenkins Compuware ISPW Operations Plugin versions 1.0.8 and earlier, update to a version that includes the necessary permission checks.
For Jenkins BMC AMI DevX Code Pipeline Operations Plugin versions 1.0.8 and earlier, update to version 1.0.9 or later, which requires the appropriate permissions to enumerate hosts and ports of Compuware configurations and credentials IDs.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jenkins
Jenkins Bmc Ami Devx Code Pipeline Operations Plugin
Jenkins Compuware Ispw Operations Plugin