Lucene search

GoogleOSV:GHSA-P37P-WG92-2FC4

HistorySep 22, 2022 - 12:00 a.m.

Missing permission checks in Jenkins CONS3RT Plugin allow enumerating credentials IDs

2022-09-2200:00:26

Google

osv.dev

jenkins

cons3rt

permission checks

http endpoints

attackers

credentials

vulnerability

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

22.0%

JSON

CONS3RT Plugin 1.0.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

References

www.openwall.com/lists/oss-security/2022/09/21/5

github.com/jenkinsci/cons3rt-plugin

nvd.nist.gov/vuln/detail/CVE-2022-41252

www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2752

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

22.0%

JSON

Related for OSV:GHSA-P37P-WG92-2FC4