Lucene search

GoogleOSV:GHSA-M8W5-VWQ3-GP8F

HistoryJul 28, 2022 - 12:00 a.m.

Lucene-Search Plugin does not perform permission checks in several HTTP endpoints

2022-07-2800:00:42

Google

osv.dev

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

20.8%

JSON

Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them.

CPENameOperatorVersion
org.jenkins-ci.plugins:lucene-searcheq1.10
org.jenkins-ci.plugins:lucene-searcheq1.11
org.jenkins-ci.plugins:lucene-searcheq1.1
org.jenkins-ci.plugins:lucene-searcheq4.4
org.jenkins-ci.plugins:lucene-searcheq1.6
org.jenkins-ci.plugins:lucene-searcheq3.0
org.jenkins-ci.plugins:lucene-searcheq5.1
org.jenkins-ci.plugins:lucene-searcheq2.1
org.jenkins-ci.plugins:lucene-searcheq1.3
org.jenkins-ci.plugins:lucene-searcheq1.9

Name	Operator	Version
org.jenkins-ci.plugins:lucene-search	eq	1.10
org.jenkins-ci.plugins:lucene-search	eq	1.11
org.jenkins-ci.plugins:lucene-search	eq	1.1
org.jenkins-ci.plugins:lucene-search	eq	4.4
org.jenkins-ci.plugins:lucene-search	eq	1.6
org.jenkins-ci.plugins:lucene-search	eq	3.0
org.jenkins-ci.plugins:lucene-search	eq	5.1
org.jenkins-ci.plugins:lucene-search	eq	2.1
org.jenkins-ci.plugins:lucene-search	eq	1.3
org.jenkins-ci.plugins:lucene-search	eq	1.9

Rows per page:

1-10 of 231

References

www.openwall.com/lists/oss-security/2022/07/27/1

github.com/jenkinsci/lucene-search-plugin/commit/b56e0aba81a355356d20824e81038e9720bc7e2e

nvd.nist.gov/vuln/detail/CVE-2022-36910

www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2048

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

20.8%

JSON

Related for OSV:GHSA-M8W5-VWQ3-GP8F