CVE-2022-20616

A missing permissions validation vulnerability was found in the Jenkins Credentials Binding plugin. The form validation method does not perform a permission check which allows attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it’s a z...

CVE-2022-20616

Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file...

CVE-2022-20616

CVE-2022-20616 refers to the Jenkins Credentials Binding Plugin (version ≤ 1.27) where a missing permission check in the form-validation method allows users with Overall/Read access to determine whether a given credential ID points to a secret file credential and whether it is a ZIP file. The des...