CVE-2022-20620

2022-01-1220:15:09

Google

osv.dev

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.0%

JSON

Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins.

CPENameOperatorVersion
ssh-agent-plugineqssh-agent-1.20
ssh-agent-plugineqssh-agent-1.12
ssh-agent-plugineqssh-agent-1.4
ssh-agent-plugineqssh-agent-1.7
ssh-agent-plugineqssh-agent-1.16
ssh-agent-plugineqssh-agent-1.22
ssh-agent-plugineqssh-agent-1.13
ssh-agent-plugineqssh-agent-1.23
ssh-agent-plugineqssh-agent-0.1
ssh-agent-plugineqssh-agent-1.11

Name	Operator	Version
ssh-agent-plugin	eq	ssh-agent-1.20
ssh-agent-plugin	eq	ssh-agent-1.12
ssh-agent-plugin	eq	ssh-agent-1.4
ssh-agent-plugin	eq	ssh-agent-1.7
ssh-agent-plugin	eq	ssh-agent-1.16
ssh-agent-plugin	eq	ssh-agent-1.22
ssh-agent-plugin	eq	ssh-agent-1.13
ssh-agent-plugin	eq	ssh-agent-1.23
ssh-agent-plugin	eq	ssh-agent-0.1
ssh-agent-plugin	eq	ssh-agent-1.11