Missing permission checks in Jenkins kubernetes-cd Plugin allow enumerating credentials IDs

2022-03-1600:00:43

Google

osv.dev

0.001 Low

EPSS

Percentile

28.5%

JSON

kubernetes-cd Plugin 2.3.1 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

CPENameOperatorVersion
org.jenkins-ci.plugins:kubernetes-cdeq0.2.1
org.jenkins-ci.plugins:kubernetes-cdeq0.1.5
org.jenkins-ci.plugins:kubernetes-cdeq2.0.0
org.jenkins-ci.plugins:kubernetes-cdeq0.1.3
org.jenkins-ci.plugins:kubernetes-cdeq0.2.3
org.jenkins-ci.plugins:kubernetes-cdeq2.0.1
org.jenkins-ci.plugins:kubernetes-cdeq2.2.0
org.jenkins-ci.plugins:kubernetes-cdeq0.1.1
org.jenkins-ci.plugins:kubernetes-cdeq1.0.0
org.jenkins-ci.plugins:kubernetes-cdeq0.1.2

Name	Operator	Version
org.jenkins-ci.plugins:kubernetes-cd	eq	0.2.1
org.jenkins-ci.plugins:kubernetes-cd	eq	0.1.5
org.jenkins-ci.plugins:kubernetes-cd	eq	2.0.0
org.jenkins-ci.plugins:kubernetes-cd	eq	0.1.3
org.jenkins-ci.plugins:kubernetes-cd	eq	0.2.3
org.jenkins-ci.plugins:kubernetes-cd	eq	2.0.1
org.jenkins-ci.plugins:kubernetes-cd	eq	2.2.0
org.jenkins-ci.plugins:kubernetes-cd	eq	0.1.1
org.jenkins-ci.plugins:kubernetes-cd	eq	1.0.0
org.jenkins-ci.plugins:kubernetes-cd	eq	0.1.2