CVE-2022-30952: Insufficiently Protected Credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin
Summary
CVE-2022-30952: Insufficiently Protected Credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin. Affects io.jenkins.blueocean:blueocean-pipeline-scm-api versions < 1.25.4. Fixed in 1.25.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Pipeline SCM API for Blue Ocean Plugin is a component of the Blue Ocean plugin for Jenkins, which provides a modern and intuitive user interface for creating and managing pipelines. It allows users to create pipelines using the pipeline creation wizard and store credentials in the per-user credentials store. These credentials are used to scan repositories and checkout from SCM. However, prior to version 1.25.4, the Blue Ocean Credentials Provider in the plugin did not sufficiently protect these credentials, allowing attackers with Job/Configure permission to access and capture any specified credential from any user's private credentials store.
Vulnerability Detail
The vulnerability in the Jenkins Pipeline SCM API for Blue Ocean Plugin allows attackers with Job/Configure permission to rewrite job configurations and gain access to credentials stored in the per-user credentials store. This can lead to unauthorized access to sensitive information and potential misuse of these credentials. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.25.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Administrators are advised to follow the steps mentioned in the 'how_to_fix' section to mitigate the vulnerability.
Conclusion
The Jenkins Pipeline SCM API for Blue Ocean Plugin is vulnerable to an insufficiently protected credentials issue, which can lead to unauthorized access to sensitive information. Administrators should update the plugin to version 1.25.4 or later and reconfigure affected pipelines to use credentials from the Jenkins credential store or a folder credential store. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.blueocean:blueocean-pipeline-scm-api →
FAQ
The vulnerability allows attackers with Job/Configure permission to access and capture credentials stored in the per-user credentials store. This can lead to unauthorized access to sensitive information and potential misuse of these credentials.
To fix the vulnerability, administrators should update the Pipeline SCM API for Blue Ocean Plugin to version 1.25.4 or later and reconfigure affected pipelines to use credentials from the Jenkins credential store or a folder credential store.
There is no specific workaround mentioned for this vulnerability. Administrators are advised to follow the steps mentioned in the 'how_to_fix' section to mitigate the vulnerability.
Re-enabling the Blue Ocean Credentials Provider is discouraged, as it restores the unsafe behavior. It is recommended to use credentials from the Jenkins credential store or a folder credential store.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
