Lucene search

GitHub Advisory DatabaseGHSA-HCW3-6459-PWHC

HistoryOct 19, 2022 - 7:00 p.m.

Jenkins Compuware Strobe Measurement Plugin Missing Authorization vulnerability

2022-10-1919:00:22

CWE-862

GitHub Advisory Database

github.com

jenkins

compuware

strobe measurement plugin

missing authorization

vulnerability

http endpoint

overall permission

enumeration

credentials stored

software

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

22.0%

JSON

Jenkins Compuware Strobe Measurement Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Affected configurations

Vulners

Node

jenkinscompuware_strobe_measurementRange≤1.0.1wordpress

CPENameOperatorVersion
com.compuware.jenkins:compuware-strobe-measurementle1.0.1

CPE	Name	Operator	Version
	com.compuware.jenkins:compuware-strobe-measurement	le	1.0.1

References

www.openwall.com/lists/oss-security/2022/10/19/3

github.com/advisories/GHSA-hcw3-6459-pwhc

github.com/jenkinsci/compuware-strobe-measurement-plugin/commit/29a0d38d12e31ff8538473742c05a2e11f15c0df

nvd.nist.gov/vuln/detail/CVE-2022-43431

www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2631

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

22.0%

JSON

Related for GHSA-HCW3-6459-PWHC