CVE-2022-45379

2022-11-1520:15:11

Google

osv.dev

cve-2022-45379

jenkins script security plugin

whole-script approvals

sha-1 hash

collision attacks

software

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

52.6%

JSON

Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vulnerable to collision attacks.

CPENameOperatorVersion
script-security-plugineqscript-security-1.44
script-security-plugineqscript-security-1.15
script-security-plugineqscript-security-1.69
script-security-plugineqscript-security-1.6
script-security-plugineqscript-security-1.52
script-security-plugineq1125.v132f99385e1b_
script-security-plugineqscript-security-1.38
script-security-plugineqscript-security-1.20
script-security-plugineqscript-security-1.72
script-security-plugineqscript-security-1.53

Name	Operator	Version
script-security-plugin	eq	script-security-1.44
script-security-plugin	eq	script-security-1.15
script-security-plugin	eq	script-security-1.69
script-security-plugin	eq	script-security-1.6
script-security-plugin	eq	script-security-1.52
script-security-plugin	eq	1125.v132f99385e1b_
script-security-plugin	eq	script-security-1.38
script-security-plugin	eq	script-security-1.20
script-security-plugin	eq	script-security-1.72
script-security-plugin	eq	script-security-1.53