CVE-2022-23106

2022-01-1220:15:09

Google

osv.dev

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.5%

JSON

Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token.

CPENameOperatorVersion
configuration-as-code-plugineqconfiguration-as-code-1.11
configuration-as-code-plugineqconfiguration-as-code-1.29
configuration-as-code-plugineqconfiguration-as-code-1.0-rc1
configuration-as-code-plugineqconfiguration-as-code-1.14
configuration-as-code-plugineqconfiguration-as-code-1.44
configuration-as-code-plugineqconfiguration-as-code-0.5-alpha
configuration-as-code-plugineqconfiguration-as-code-1.18
configuration-as-code-plugineqconfiguration-as-code-1.20
configuration-as-code-plugineqconfiguration-as-code-1.7
configuration-as-code-plugineqconfiguration-as-code-1.53

Name	Operator	Version
configuration-as-code-plugin	eq	configuration-as-code-1.11
configuration-as-code-plugin	eq	configuration-as-code-1.29
configuration-as-code-plugin	eq	configuration-as-code-1.0-rc1
configuration-as-code-plugin	eq	configuration-as-code-1.14
configuration-as-code-plugin	eq	configuration-as-code-1.44
configuration-as-code-plugin	eq	configuration-as-code-0.5-alpha
configuration-as-code-plugin	eq	configuration-as-code-1.18
configuration-as-code-plugin	eq	configuration-as-code-1.20
configuration-as-code-plugin	eq	configuration-as-code-1.7
configuration-as-code-plugin	eq	configuration-as-code-1.53