Unprivileged users with Overall/Read access are able to enumerate credential IDs in Azure VM Agents Plugin

2022-05-1301:15:07

Google

osv.dev

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.2%

JSON

An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java that allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CPENameOperatorVersion
org.jenkins-ci.plugins:azure-vm-agentseq0.7.1
org.jenkins-ci.plugins:azure-vm-agentseq0.4.0
org.jenkins-ci.plugins:azure-vm-agentseq0.7.3
org.jenkins-ci.plugins:azure-vm-agentseq0.4.7
org.jenkins-ci.plugins:azure-vm-agentseq0.5.0
org.jenkins-ci.plugins:azure-vm-agentseq0.6.0
org.jenkins-ci.plugins:azure-vm-agentseq0.4.6
org.jenkins-ci.plugins:azure-vm-agentseq0.4.2
org.jenkins-ci.plugins:azure-vm-agentseq0.6.1
org.jenkins-ci.plugins:azure-vm-agentseq0.4.7.1

Name	Operator	Version
org.jenkins-ci.plugins:azure-vm-agents	eq	0.7.1
org.jenkins-ci.plugins:azure-vm-agents	eq	0.4.0
org.jenkins-ci.plugins:azure-vm-agents	eq	0.7.3
org.jenkins-ci.plugins:azure-vm-agents	eq	0.4.7
org.jenkins-ci.plugins:azure-vm-agents	eq	0.5.0
org.jenkins-ci.plugins:azure-vm-agents	eq	0.6.0
org.jenkins-ci.plugins:azure-vm-agents	eq	0.4.6
org.jenkins-ci.plugins:azure-vm-agents	eq	0.4.2
org.jenkins-ci.plugins:azure-vm-agents	eq	0.6.1
org.jenkins-ci.plugins:azure-vm-agents	eq	0.4.7.1