CVE-2022-36907

2022-07-2715:15:10

CWE-862

[email protected]

web.nvd.nist.gov

cve

2022

36907

jenkins

openshift

deployer plugin

nvd

security

vulnerability

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

22.2%

JSON

A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Affected configurations

NVD

Node

jenkinsopenshift_deployerRange≤1.2.0jenkins

CPENameOperatorVersion
jenkins:openshift_deployerjenkins openshift deployerle1.2.0

CPE	Name	Operator	Version
jenkins:openshift_deployer	jenkins openshift deployer	le	1.2.0

CNA Affected

[
  {
    "product": "Jenkins OpenShift Deployer Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "1.2.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unknown",
        "version": "next of 1.2.0",
        "versionType": "custom"
      }
    ]
  }
]