CVE-2022-20616

A missing permissions validation vulnerability was found in the Jenkins Credentials Binding plugin. The form validation method does not perform a permission check which allows attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it’s a z...

com.amazon.jenkins.fleet:ec2-fleet (>=1.0, <=1.17.3), com.cloudbees.jenkins.plugins:amazon-ecr (1.6) +50 more potentially affected by CVE-2022-20616 via org.jenkins-ci.plugins:credentials-binding (>=1.7, <=1.24)

org.jenkins-ci.plugins:credentials-binding MAVEN version =1.7, =1.0, =1.4, =0.17, =1.0.43, =1.0.0-b13, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.2.0-beta-1 and more Source cves: CVE-2022-20616 Source advisory: GHSA-GQM2-2GCX-P88W...

CVE-2022-20616

Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file...

CVE-2022-20616

CVE-2022-20616 refers to the Jenkins Credentials Binding Plugin (version ≤ 1.27) where a missing permission check in the form-validation method allows users with Overall/Read access to determine whether a given credential ID points to a secret file credential and whether it is a ZIP file. The des...