Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

GHSA-5fvg-h778-jjjx

GitHub Security Advisory

Missing permission checks in Jenkins Katalon Plugin allow capturing credentials

✓ GitHub Reviewed MODERATE Has CVE
View on GitHub

Advisory Details

Katalon Plugin 1.0.32 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Katalon Plugin 1.0.33 properly performs permission checks when accessing the affected HTTP endpoints.

Affected Packages

Maven org.jenkins-ci.plugins:katalon
Affected versions: 0 (fixed in 1.0.33)

Related CVEs

CVE-2022-43417

Key Information

GHSA ID
GHSA-5fvg-h778-jjjx
Published
October 19, 2022 7:00 PM
Last Modified
December 16, 2022 5:27 PM
CVSS Score
5.0 /10
Primary Ecosystem
Maven
Primary Package
org.jenkins-ci.plugins:katalon
GitHub Reviewed
✓ Yes

Dataset

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.