Jenkins RQM Plugin allows enumerating credentials IDs due to missing permission check

MEDIUM 6.5CVE-2022-34810 · GHSA-2348-ccqj-8p27 · Published 30/06/2022 · updated 17/06/2026

In short

CVE-2022-34810 is a MEDIUM (CVSS 6.5) vulnerability affecting net.praqma:rqm-plugin, rqm (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.74%, higher than 54.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
net.praqma:rqm-plugin Maven	`≤ 2.8`	No fix yet
rqm jenkins	`≤ 2.8`	No fix yet

Description

Jenkins RQM Plugin 2.8 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

NVD description

A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

References

nvd.nist.gov/vuln/detail/CVE-2022-34810 · ADVISORY
jenkinsci/rqm-plugin · PACKAGE
jenkins.io/security/advisory/2022-06-30 · WEB

More vulnerabilities in net.praqma:rqm-plugin

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

net.praqma:rqm-plugin

Maven

≤ 2.8

No fix yet

rqm

jenkins

≤ 2.8

No fix yet

Description

NVD description

A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

More vulnerabilities in net.praqma:rqm-plugin

See all →