Jenkins Repository Connector Plugin allows attackers with Overall/Read permission to enumerate credentials IDs

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-36903 · ADVISORY
• jenkins.io/security/advisory/2022-07-27 · WEB
• jenkins.io/security/advisory/2022-07-27 · WEB
• openwall.com/lists/oss-security/2022/07/27/1 · WEB

org.jenkins-ci.plugins:repository-connector のその他の脆弱性

• CVE-2022-36904中 4.3Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation, allowing…
• CVE-2022-34195中 5.4Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on vi…
• CVE-2021-21618中 5.4Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a store…
• CVE-2020-2149中 5.3Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configura…
• CVE-2019-1003038高 7.8An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/j…