CVE-2022-20616

2022-01-1220:15:08

Google

osv.dev

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.0%

JSON

Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it’s a zip file.

CPENameOperatorVersion
credentials-binding-plugineqcredentials-binding-1.0-beta-1
credentials-binding-plugineqcredentials-binding-1.7
credentials-binding-plugineqcredentials-binding-1.14
credentials-binding-plugineqcredentials-binding-1.0
credentials-binding-plugineqcredentials-binding-1.5
credentials-binding-plugineqcredentials-binding-1.12
credentials-binding-plugineqcredentials-binding-1.9
credentials-binding-plugineqcredentials-binding-1.20
credentials-binding-plugineqcredentials-binding-1.15
credentials-binding-plugineqcredentials-binding-1.8

Name	Operator	Version
credentials-binding-plugin	eq	credentials-binding-1.0-beta-1
credentials-binding-plugin	eq	credentials-binding-1.7
credentials-binding-plugin	eq	credentials-binding-1.14
credentials-binding-plugin	eq	credentials-binding-1.0
credentials-binding-plugin	eq	credentials-binding-1.5
credentials-binding-plugin	eq	credentials-binding-1.12
credentials-binding-plugin	eq	credentials-binding-1.9
credentials-binding-plugin	eq	credentials-binding-1.20
credentials-binding-plugin	eq	credentials-binding-1.15
credentials-binding-plugin	eq	credentials-binding-1.8