CVE-2022-30957

2022-05-1715:15:09

Google

osv.dev

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.0%

JSON

A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CPENameOperatorVersion
ssh-plugineqssh-2.2
ssh-plugineqssh-2.1
ssh-plugineqssh-1.3
ssh-plugineqssh-2.6
ssh-plugineqssh-2.5
ssh-plugineqssh-1.6
ssh-plugineqssh-1.7
ssh-plugineqssh-1.5
ssh-plugineqssh-2.4
ssh-plugineqssh-2.6.1

Name	Operator	Version
ssh-plugin	eq	ssh-2.2
ssh-plugin	eq	ssh-2.1
ssh-plugin	eq	ssh-1.3
ssh-plugin	eq	ssh-2.6
ssh-plugin	eq	ssh-2.5
ssh-plugin	eq	ssh-1.6
ssh-plugin	eq	ssh-1.7
ssh-plugin	eq	ssh-1.5
ssh-plugin	eq	ssh-2.4
ssh-plugin	eq	ssh-2.6.1