Jenkins CRX Content Package Deployer Plugin subject to credentials enumeration via Missing Authorization

2022-05-2416:58:49

Google

osv.dev

0.001 Low

EPSS

Percentile

22.2%

JSON

A missing permission check in Jenkins CRX Content Package Deployer Plugin prior to version 1.9 in various ‘doFillCredentialsIdItems’ methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. This issue is patched in version 1.9.

CPENameOperatorVersion
org.jenkins-ci.plugins:crx-content-package-deployereq1.6
org.jenkins-ci.plugins:crx-content-package-deployereq1.1
org.jenkins-ci.plugins:crx-content-package-deployereq1.5.3
org.jenkins-ci.plugins:crx-content-package-deployereq1.0
org.jenkins-ci.plugins:crx-content-package-deployereq1.5
org.jenkins-ci.plugins:crx-content-package-deployereq1.8.1
org.jenkins-ci.plugins:crx-content-package-deployereq1.7.2
org.jenkins-ci.plugins:crx-content-package-deployereq1.3.1
org.jenkins-ci.plugins:crx-content-package-deployereq1.5.1
org.jenkins-ci.plugins:crx-content-package-deployereq1.3

Name	Operator	Version
org.jenkins-ci.plugins:crx-content-package-deployer	eq	1.6
org.jenkins-ci.plugins:crx-content-package-deployer	eq	1.1
org.jenkins-ci.plugins:crx-content-package-deployer	eq	1.5.3
org.jenkins-ci.plugins:crx-content-package-deployer	eq	1.0
org.jenkins-ci.plugins:crx-content-package-deployer	eq	1.5
org.jenkins-ci.plugins:crx-content-package-deployer	eq	1.8.1
org.jenkins-ci.plugins:crx-content-package-deployer	eq	1.7.2
org.jenkins-ci.plugins:crx-content-package-deployer	eq	1.3.1
org.jenkins-ci.plugins:crx-content-package-deployer	eq	1.5.1
org.jenkins-ci.plugins:crx-content-package-deployer	eq	1.3