Lucene search

GoogleOSV:GHSA-RQQX-FVQX-539G

HistoryJul 28, 2022 - 12:00 a.m.

Jenkins Deployer Framework Plugin allows attackers with Item/Read permission to read deployment logs

2022-07-2800:00:42

Google

osv.dev

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.3 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

20.8%

JSON

Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Item/Read permission to read deployment logs.

Deployer Framework Plugin 86.v7b_a_4a_55b_f3ec requires Deploy Now/Deploy permission to read deployment logs.

CPENameOperatorVersion
org.jenkins-ci.plugins:deployer-frameworkeq1.3
org.jenkins-ci.plugins:deployer-frameworkeq1.3.1
org.jenkins-ci.plugins:deployer-frameworkeq64.v3400230d12da_
org.jenkins-ci.plugins:deployer-frameworkeq1.0
org.jenkins-ci.plugins:deployer-frameworkeq1.2
org.jenkins-ci.plugins:deployer-frameworkeq85.v1d1888e8c021
org.jenkins-ci.plugins:deployer-frameworkeq1.1
org.jenkins-ci.plugins:deployer-frameworkeq69.v0fcb_86e90e08
org.jenkins-ci.plugins:deployer-frameworkeq75.vcc73e3a_89e64

Name	Operator	Version
org.jenkins-ci.plugins:deployer-framework	eq	1.3
org.jenkins-ci.plugins:deployer-framework	eq	1.3.1
org.jenkins-ci.plugins:deployer-framework	eq	64.v3400230d12da_
org.jenkins-ci.plugins:deployer-framework	eq	1.0
org.jenkins-ci.plugins:deployer-framework	eq	1.2
org.jenkins-ci.plugins:deployer-framework	eq	85.v1d1888e8c021
org.jenkins-ci.plugins:deployer-framework	eq	1.1
org.jenkins-ci.plugins:deployer-framework	eq	69.v0fcb_86e90e08
org.jenkins-ci.plugins:deployer-framework	eq	75.vcc73e3a_89e64

References

www.openwall.com/lists/oss-security/2022/07/27/1

github.com/jenkinsci/deployer-framework-plugin/commit/7ba4a55bf3ec567ee5325ea7b24b4086ac1cb3ad

nvd.nist.gov/vuln/detail/CVE-2022-36891

www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2205

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.3 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

20.8%

JSON

Related for OSV:GHSA-RQQX-FVQX-539G