Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2022-36896

UNKNOWN
Published 2022-07-27T14:23:58
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2022-36896. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

A missing permission check in Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

Jenkins project

Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin

Affected Versions:

unspecified

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed MODERATE

Jenkins Compuware Source Code Download is missing authorization

GHSA-75fc-fv3p-xh82

Advisory Details

BMC Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins. Those credentials IDs can be used as part of an attack to capture the credentials using another vulnerability. BMC Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.13 requires the appropriate permissions to enumerate hosts and ports of Compuware configurations and credentials IDs.

Affected Packages

Maven com.compuware.jenkins:compuware-scm-downloader
ECOSYSTEM: ≥0 <2.0.13

CVSS Scoring

CVSS Score

5.0

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2022-36896
WEB https://github.com/jenkinsci/compuware-scm-downloader-plugin/commit/bf00665b13641351a9f67027bbe34609cc4f65e2
PACKAGE https://github.com/jenkinsci/compuware-scm-downloader-plugin
WEB https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2621
WEB http://www.openwall.com/lists/oss-security/2022/07/27/1

Advisory provided by GitHub Security Advisory Database. Published: July 28, 2022, Modified: December 12, 2022

References

https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2621
http://www.openwall.com/lists/oss-security/2022/07/27/1
Published: 2022-07-27T14:23:58
Last Modified: 2024-08-03T10:14:29.495Z
Copied to clipboard!