Jenkins Compuware Topaz for Total Test Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins

2022-10-1919:00:18

Google

osv.dev

0.001 Low

EPSS

Percentile

21.7%

JSON

Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CPENameOperatorVersion
com.compuware.jenkins:compuware-topaz-for-total-testeq1.8.1
com.compuware.jenkins:compuware-topaz-for-total-testeq2.3.1
com.compuware.jenkins:compuware-topaz-for-total-testeq2.3.0
com.compuware.jenkins:compuware-topaz-for-total-testeq2.3.7
com.compuware.jenkins:compuware-topaz-for-total-testeq2.4.3
com.compuware.jenkins:compuware-topaz-for-total-testeq1.8.2
com.compuware.jenkins:compuware-topaz-for-total-testeq2.3.12
com.compuware.jenkins:compuware-topaz-for-total-testeq2.1.3
com.compuware.jenkins:compuware-topaz-for-total-testeq2.3.4
com.compuware.jenkins:compuware-topaz-for-total-testeq2.1.2

Name	Operator	Version
com.compuware.jenkins:compuware-topaz-for-total-test	eq	1.8.1
com.compuware.jenkins:compuware-topaz-for-total-test	eq	2.3.1
com.compuware.jenkins:compuware-topaz-for-total-test	eq	2.3.0
com.compuware.jenkins:compuware-topaz-for-total-test	eq	2.3.7
com.compuware.jenkins:compuware-topaz-for-total-test	eq	2.4.3
com.compuware.jenkins:compuware-topaz-for-total-test	eq	1.8.2
com.compuware.jenkins:compuware-topaz-for-total-test	eq	2.3.12
com.compuware.jenkins:compuware-topaz-for-total-test	eq	2.1.3
com.compuware.jenkins:compuware-topaz-for-total-test	eq	2.3.4
com.compuware.jenkins:compuware-topaz-for-total-test	eq	2.1.2