Design/Logic Flaw

2022-10-1916:15:00

PRIOn knowledge base

www.prio-n.com

jenkins

katalon plugin

permission checks

http endpoints

attackers

credentials

nvd

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.0%

JSON

Jenkins Katalon Plugin 1.0.32 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.