CVE-2022-30952

2022-05-1715:15:09

Google

osv.dev

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.5%

JSON

Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.

CPENameOperatorVersion
blueocean-plugineqblueocean-parent-1.0.0-rc3
blueocean-plugineqblueocean-parent-1.25.1
blueocean-plugineqblueocean-parent-1.0.0-b04
blueocean-plugineqblueocean-parent-1.1.0-beta-2
blueocean-plugineqblueocean-parent-1.1.0-beta-8
blueocean-plugineqblueocean-parent-1.0.0-b03
blueocean-plugineqblueocean-parent-1.0.0-b10
blueocean-plugineqblueocean-parent-1.5.0-beta-1
blueocean-plugineqblueocean-parent-1.0.0-b15
blueocean-plugineqblueocean-parent-1.0.0-b08

Name	Operator	Version
blueocean-plugin	eq	blueocean-parent-1.0.0-rc3
blueocean-plugin	eq	blueocean-parent-1.25.1
blueocean-plugin	eq	blueocean-parent-1.0.0-b04
blueocean-plugin	eq	blueocean-parent-1.1.0-beta-2
blueocean-plugin	eq	blueocean-parent-1.1.0-beta-8
blueocean-plugin	eq	blueocean-parent-1.0.0-b03
blueocean-plugin	eq	blueocean-parent-1.0.0-b10
blueocean-plugin	eq	blueocean-parent-1.5.0-beta-1
blueocean-plugin	eq	blueocean-parent-1.0.0-b15
blueocean-plugin	eq	blueocean-parent-1.0.0-b08