CVE-2022-25195: Missing permission check in Jenkins autonomiq Plugin
Summary
CVE-2022-25195: Missing permission check in Jenkins autonomiq Plugin. Affects io.jenkins.plugins:autonomiq versions < 1.16. Fixed in 1.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins autonomiq Plugin is a Maven package that provides functionality for connecting to a specified URL using specified credentials. It is commonly used in Jenkins environments to automate tasks and streamline workflows. However, a vulnerability has been discovered in versions 1.15 and earlier of the plugin, which allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
Vulnerability Detail
The vulnerability in the Jenkins autonomiq Plugin arises from a missing permission check. This means that any user with Overall/Read permission can exploit the vulnerability by connecting to a URL of their choice with credentials they specify. The impact of this vulnerability can be significant, as it allows unauthorized access to external systems and potentially exposes sensitive information. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.16
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the plugin to mitigate the risk.
Conclusion
In conclusion, the Jenkins autonomiq Plugin versions 1.15 and earlier are vulnerable to a missing permission check, allowing attackers with Overall/Read permission to connect to attacker-specified URLs with attacker-specified credentials. To mitigate this risk, it is crucial to upgrade to version 1.16 or later of the plugin. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:autonomiq →
FAQ
The vulnerability allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials, potentially leading to unauthorized access and exposure of sensitive information.
Users of Jenkins autonomiq Plugin versions 1.15 and earlier are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is necessary to upgrade to the fixed version of the plugin.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
To fix this vulnerability, upgrade to version 1.16 or later of the Jenkins autonomiq Plugin.
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.plugins:autonomiq.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
