Lucene search

GoogleOSV:GHSA-XFRW-PCMC-R2P3

HistoryMay 24, 2022 - 5:45 p.m.

Missing permission checks in Jenkins OWASP Dependency-Track Plugin allow capturing credentials

2022-05-2417:45:46

Google

osv.dev

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

27.4%

JSON

Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing "Secret text" credentials stored in Jenkins. If no credentials ID is specified, the globally configured credential is used, if set up, and can likewise be captured.

Jenkins OWASP Dependency-Track Plugin 3.1.1 requires appropriate permissions for the affected HTTP endpoints.

CPENameOperatorVersion
org.jenkins-ci.plugins:dependency-trackeq2.0.0
org.jenkins-ci.plugins:dependency-trackeq2.3.0
org.jenkins-ci.plugins:dependency-trackeq1.0.0
org.jenkins-ci.plugins:dependency-trackeq1.1.0
org.jenkins-ci.plugins:dependency-trackeq3.0.2
org.jenkins-ci.plugins:dependency-trackeq2.0.1
org.jenkins-ci.plugins:dependency-trackeq3.1.0
org.jenkins-ci.plugins:dependency-trackeq2.2.0
org.jenkins-ci.plugins:dependency-trackeq3.0.0
org.jenkins-ci.plugins:dependency-trackeq2.2.1

Name	Operator	Version
org.jenkins-ci.plugins:dependency-track	eq	2.0.0
org.jenkins-ci.plugins:dependency-track	eq	2.3.0
org.jenkins-ci.plugins:dependency-track	eq	1.0.0
org.jenkins-ci.plugins:dependency-track	eq	1.1.0
org.jenkins-ci.plugins:dependency-track	eq	3.0.2
org.jenkins-ci.plugins:dependency-track	eq	2.0.1
org.jenkins-ci.plugins:dependency-track	eq	3.1.0
org.jenkins-ci.plugins:dependency-track	eq	2.2.0
org.jenkins-ci.plugins:dependency-track	eq	3.0.0
org.jenkins-ci.plugins:dependency-track	eq	2.2.1

Rows per page:

1-10 of 141

References

www.openwall.com/lists/oss-security/2021/03/30/1

github.com/jenkinsci/dependency-track-plugin

github.com/jenkinsci/dependency-track-plugin/commit/70e7b82ad9a10499e628998a0bcb57c1481c66bc

nvd.nist.gov/vuln/detail/CVE-2021-21632

www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2250

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

27.4%

JSON

Related for OSV:GHSA-XFRW-PCMC-R2P3