GHSA-372F-JC47-7GR5 Missing permission check in Jenkins Conjur Secrets Plugin allows enumerating credentials IDs

🗓️ 16 Feb 2022 00:01:26Reported by GoogleType

osv🔗 osv.dev👁 18 Views

Missing permission check in Jenkins Conjur Secrets Plugin allows enumerating credentials IDs. Conjur Secrets Plugin 1.0.11 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2022-25190	15 Feb 202217:15	–	attackerkb
Tenable Nessus	Jenkins Enterprise and Operations Center 2.277.x < 2.277.43.0.7 / 2.303.x < 2.303.30.0.6 / 2.319.3.4 Multiple Vulnerabilities (CloudBees Security Advisory 2022-02-15)	8 Mar 202200:00	–	nessus
Tenable Nessus	Jenkins plugins Multiple Vulnerabilities (2022-02-15)	13 Jun 202200:00	–	nessus
CNNVD	Jenkins 插件权限许可和访问控制问题漏洞	15 Feb 202200:00	–	cnnvd
CNVD	Jenkins Conjur Secrets Plugin授权问题漏洞	17 Feb 202200:00	–	cnvd
CVE	CVE-2022-25190	15 Feb 202216:11	–	cve
Cvelist	CVE-2022-25190	15 Feb 202216:11	–	cvelist
EUVD	EUVD-2022-0779	3 Oct 202520:07	–	euvd
Github Security Blog	Missing permission check in Jenkins Conjur Secrets Plugin allows enumerating credentials IDs	16 Feb 202200:01	–	github
NVD	CVE-2022-25190	15 Feb 202217:15	–	nvd

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-25190
github	www.github.com/jenkinsci/conjur-credentials-plugin/commit/eda06cde26cdf2d40ae4e2f4d2709e8174489068
github	www.github.com/jenkinsci/conjur-credentials-plugin
jenkins	www.jenkins.io/security/advisory/2022-02-15/

08 Nov 2023 04:08Current

4.7Medium risk

Vulners AI Score4.7

CVSS 3.14.3

EPSS0.00023