Lucene search

GoogleOSV:GHSA-WWF6-X2RV-VXQH

HistoryFeb 16, 2022 - 12:01 a.m.

Missing permission checks in Jenkins Checkmarx Plugin allow capturing credentials

2022-02-1600:01:19

Google

osv.dev

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

27.4%

JSON

Checkmarx Plugin 2022.1.2 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CPENameOperatorVersion
com.checkmarx.jenkins:checkmarxeq2021.4.1
com.checkmarx.jenkins:checkmarxeq2021.4.2
com.checkmarx.jenkins:checkmarxeq2021.1.2
com.checkmarx.jenkins:checkmarxeq8.60.1
com.checkmarx.jenkins:checkmarxeq8.42.0
com.checkmarx.jenkins:checkmarxeq8.90.3
com.checkmarx.jenkins:checkmarxeq8.2.0
com.checkmarx.jenkins:checkmarxeq8.41.0
com.checkmarx.jenkins:checkmarxeq2021.3.1
com.checkmarx.jenkins:checkmarxeq8.0.1

Name	Operator	Version
com.checkmarx.jenkins:checkmarx	eq	2021.4.1
com.checkmarx.jenkins:checkmarx	eq	2021.4.2
com.checkmarx.jenkins:checkmarx	eq	2021.1.2
com.checkmarx.jenkins:checkmarx	eq	8.60.1
com.checkmarx.jenkins:checkmarx	eq	8.42.0
com.checkmarx.jenkins:checkmarx	eq	8.90.3
com.checkmarx.jenkins:checkmarx	eq	8.2.0
com.checkmarx.jenkins:checkmarx	eq	8.41.0
com.checkmarx.jenkins:checkmarx	eq	2021.3.1
com.checkmarx.jenkins:checkmarx	eq	8.0.1

Rows per page:

1-10 of 321

References

github.com/jenkinsci/checkmarx-plugin

github.com/jenkinsci/checkmarx-plugin/releases/tag/Release_2022.1.3

nvd.nist.gov/vuln/detail/CVE-2022-25201

www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1017

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

27.4%

JSON

Related for OSV:GHSA-WWF6-X2RV-VXQH