Lucene search

GoogleOSV:GHSA-9WXH-JJJ5-67CV

HistoryJan 13, 2022 - 12:00 a.m.

Missing permission checks in SSH Agent Plugin allow enumerating credentials IDs

2022-01-1300:00:58

Google

osv.dev

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

22.0%

JSON

Jenkins SSH Agent Plugin prior to 1.23.2 and 1.22.1 does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in SSH Agent Plugin 1.23.2 and 1.22.1 requires the appropriate permissions.

CPENameOperatorVersion
org.jenkins-ci.plugins:ssh-agenteq1.4
org.jenkins-ci.plugins:ssh-agenteq1.11
org.jenkins-ci.plugins:ssh-agenteq1.0
org.jenkins-ci.plugins:ssh-agenteq1.22
org.jenkins-ci.plugins:ssh-agenteq1.12
org.jenkins-ci.plugins:ssh-agenteq1.15
org.jenkins-ci.plugins:ssh-agenteq1.18
org.jenkins-ci.plugins:ssh-agenteq1.13
org.jenkins-ci.plugins:ssh-agenteq1.10
org.jenkins-ci.plugins:ssh-agenteq1.20

Name	Operator	Version
org.jenkins-ci.plugins:ssh-agent	eq	1.4
org.jenkins-ci.plugins:ssh-agent	eq	1.11
org.jenkins-ci.plugins:ssh-agent	eq	1.0
org.jenkins-ci.plugins:ssh-agent	eq	1.22
org.jenkins-ci.plugins:ssh-agent	eq	1.12
org.jenkins-ci.plugins:ssh-agent	eq	1.15
org.jenkins-ci.plugins:ssh-agent	eq	1.18
org.jenkins-ci.plugins:ssh-agent	eq	1.13
org.jenkins-ci.plugins:ssh-agent	eq	1.10
org.jenkins-ci.plugins:ssh-agent	eq	1.20

Rows per page:

1-10 of 271

References

www.openwall.com/lists/oss-security/2022/01/12/6

github.com/CVEProject/cvelist/blob/2d78eb36f4d084db7fb35f1535d8d84fdcb7d859/2022/20xxx/CVE-2022-20620.jsonhttps://github.com/CVEProject/cvelist/blob/2d78eb36f4d084db7fb35f1535d8d84fdcb7d859/2022/20xxx/CVE-2022-20620.json

github.com/jenkinsci/ssh-agent-plugin

github.com/jenkinsci/ssh-agent-plugin/commit/04f526d2f73a6fc24b59df20ba03d95265114835

github.com/jenkinsci/ssh-agent-plugin/commit/9c08b9f93cfb3ada0f0124f5bd7f0d027728a750

nvd.nist.gov/vuln/detail/CVE-2022-20620

www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2189

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

22.0%

JSON

Related for OSV:GHSA-9WXH-JJJ5-67CV