Missing permission checks in Jenkins Katalon Plugin allow capturing credentials

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-43417 · ADVISORY
• jenkinsci/katalon-plugin · PACKAGE
• jenkins.io/security/advisory/2022-10-19 · WEB
• openwall.com/lists/oss-security/2022/10/19/3 · WEB
• jenkins.io/security/advisory/2022-10-19 · Vendor Advisory

Autres vulnérabilités de org.jenkins-ci.plugins:katalon

• CVE-2022-43419MOYENNE 6.5Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller where they can be vi…
• CVE-2022-43418MOYENNE 4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Katalon Plugin 1.0.33 and earlier allows attackers to connect to an attacker-sp…
• CVE-2022-43416ÉLEVÉE 8.8Jenkins Katalon Plugin 1.0.32 and earlier implements an agent/controller message that does not limit where it can be executed and allows inv…