Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2022-20616

UNKNOWN
Published 2022-01-12T19:05:51
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2022-20616. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

Jenkins project

Jenkins Credentials Binding Plugin

Affected Versions:

unspecified 1.24.1

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed MODERATE

Incorrect Permission Assignment for Critical Resource in Jenkins Credentials Binding Plugin

GHSA-gqm2-2gcx-p88w

Advisory Details

Jenkins Credentials Binding Plugin prior to 1.27.1 and 1.24.1 does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it’s a zip file. Credentials Binding Plugin 1.27.1 and 1.24.1 performs permission checks when validating secret file credentials IDs.

Affected Packages

Maven org.jenkins-ci.plugins:credentials-binding
ECOSYSTEM: ≥1.25 <1.27.1
Maven org.jenkins-ci.plugins:credentials-binding
ECOSYSTEM: ≥0 <1.24.1

CVSS Scoring

CVSS Score

5.0

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2022-20616
WEB https://github.com/jenkinsci/credentials-binding-plugin/commit/2dd5eda721e52d9a5bf6748405adf965ba517d8a
WEB https://github.com/CVEProject/cvelist/blob/2d78eb36f4d084db7fb35f1535d8d84fdcb7d859/2022/20xxx/CVE-2022-20616.json
PACKAGE https://github.com/jenkinsci/credentials-binding-plugin
WEB https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2342
WEB http://www.openwall.com/lists/oss-security/2022/01/12/6

Advisory provided by GitHub Security Advisory Database. Published: January 13, 2022, Modified: July 3, 2024

References

https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2342
http://www.openwall.com/lists/oss-security/2022/01/12/6
Published: 2022-01-12T19:05:51
Last Modified: 2024-08-03T02:17:52.979Z
Copied to clipboard!