CVE-2022-43417

2022-10-1916:15:11

Google

osv.dev

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.7%

JSON

Jenkins Katalon Plugin 1.0.32 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CPENameOperatorVersion
katalon-plugineqkatalon-1.0.0
katalon-plugineqkatalon-1.0.5
katalon-plugineqkatalon-1.0.23
katalon-plugineqkatalon-1.0.17
katalon-plugineqkatalon-1.0.2
katalon-plugineqkatalon-1.0.7
katalon-plugineqkatalon-1.0.9
katalon-plugineqkatalon-1.0.8
katalon-plugineq1.0.29
katalon-plugineqkatalon-1.0.6

Name	Operator	Version
katalon-plugin	eq	katalon-1.0.0
katalon-plugin	eq	katalon-1.0.5
katalon-plugin	eq	katalon-1.0.23
katalon-plugin	eq	katalon-1.0.17
katalon-plugin	eq	katalon-1.0.2
katalon-plugin	eq	katalon-1.0.7
katalon-plugin	eq	katalon-1.0.9
katalon-plugin	eq	katalon-1.0.8
katalon-plugin	eq	1.0.29
katalon-plugin	eq	katalon-1.0.6