Jenkins Repository Connector Plugin allows attackers with Overall/Read permission to enumerate credentials IDs

MEDIUM 4.3CVE-2022-36903 · GHSA-76pg-mr9v-5vwc · Published 27/07/2022 · updated 17/06/2026

In short

CVE-2022-36903 is a MEDIUM (CVSS 4.3) vulnerability affecting org.jenkins-ci.plugins:repository-connector, repository connector (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.71%, higher than 53.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:repository-connector Maven	`≤ 2.2.0`	No fix yet
repository connector jenkins	`≤ 2.2.0`	No fix yet

Description

Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

As of publication of this advisory, there is no fix.

NVD description

A missing permission check in Jenkins Repository Connector Plugin 2.2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

References

nvd.nist.gov/vuln/detail/CVE-2022-36903 · ADVISORY
jenkins.io/security/advisory/2022-07-27 · WEB
jenkins.io/security/advisory/2022-07-27 · WEB
openwall.com/lists/oss-security/2022/07/27/1 · WEB

More vulnerabilities in org.jenkins-ci.plugins:repository-connector

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In short

CVE-2022-36903 is a MEDIUM (CVSS 4.3) vulnerability affecting org.jenkins-ci.plugins:repository-connector, repository connector (jenkins).

Chance of exploitation in the next 30 days (EPSS): 0.71%, higher than 53.7% of all vulnerabilities.

No patched version is listed yet: follow the vendor's advisory in References.

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:repository-connector

Maven

≤ 2.2.0

No fix yet

repository connector

jenkins

≤ 2.2.0

No fix yet

Description

Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform permission checks in several HTTP endpoints.

As of publication of this advisory, there is no fix.

NVD description

A missing permission check in Jenkins Repository Connector Plugin 2.2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

More vulnerabilities in org.jenkins-ci.plugins:repository-connector

See all →