Missing permission checks in AWS Credentials Plugin

2022-03-1600:00:44

Google

osv.dev

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.2%

JSON

A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.

CPENameOperatorVersion
org.jenkins-ci.plugins:aws-credentialseq1.19
org.jenkins-ci.plugins:aws-credentialseq1.9
org.jenkins-ci.plugins:aws-credentialseq1.16
org.jenkins-ci.plugins:aws-credentialseq189.v3551d5642995
org.jenkins-ci.plugins:aws-credentialseq1.27
org.jenkins-ci.plugins:aws-credentialseq1.28.2
org.jenkins-ci.plugins:aws-credentialseq1.24
org.jenkins-ci.plugins:aws-credentialseq1.14
org.jenkins-ci.plugins:aws-credentialseq1.32
org.jenkins-ci.plugins:aws-credentialseq1.28.1

Name	Operator	Version
org.jenkins-ci.plugins:aws-credentials	eq	1.19
org.jenkins-ci.plugins:aws-credentials	eq	1.9
org.jenkins-ci.plugins:aws-credentials	eq	1.16
org.jenkins-ci.plugins:aws-credentials	eq	189.v3551d5642995
org.jenkins-ci.plugins:aws-credentials	eq	1.27
org.jenkins-ci.plugins:aws-credentials	eq	1.28.2
org.jenkins-ci.plugins:aws-credentials	eq	1.24
org.jenkins-ci.plugins:aws-credentials	eq	1.14
org.jenkins-ci.plugins:aws-credentials	eq	1.32
org.jenkins-ci.plugins:aws-credentials	eq	1.28.1