CVE-2022-34212: Missing permission check in Jenkins vRealize Orchestrator Plugin
Summary
CVE-2022-34212: Missing permission check in Jenkins vRealize Orchestrator Plugin. Affects org.jenkins-ci.plugins:vmware-vrealize-orchestrator versions < 3.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins vRealize Orchestrator Plugin is a Maven package that provides integration between Jenkins and VMware vRealize Orchestrator. It allows users to automate and orchestrate tasks in their Jenkins pipelines using vRealize Orchestrator workflows. The plugin is widely used in DevOps environments to streamline the deployment and management of applications. However, a vulnerability has been discovered in versions 3.0 and earlier of the plugin.
Vulnerability Detail
The vulnerability in the Jenkins vRealize Orchestrator Plugin arises from a missing permission check. Attackers with Overall/Read permission can exploit this vulnerability by sending an HTTP POST request to a URL specified by the attacker. This can lead to unauthorized access and potential data leakage or manipulation. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the patch or upgrade to the fixed version as soon as possible.
Conclusion
In conclusion, the Jenkins vRealize Orchestrator Plugin is vulnerable to a missing permission check, allowing attackers with Overall/Read permission to send unauthorized HTTP POST requests. To mitigate this vulnerability, users should upgrade to version 3.1 of the plugin or apply the provided patch. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:vmware-vrealize-orchestrator →
FAQ
The vulnerability allows attackers with Overall/Read permission to send unauthorized HTTP POST requests, potentially leading to data leakage or manipulation.
Users of Jenkins vRealize Orchestrator Plugin versions 3.0 and earlier are affected by this vulnerability.
Yes, a fix has been released in version 3.1 of the Jenkins vRealize Orchestrator Plugin. Users should upgrade to this version to mitigate the vulnerability.
No, there are no known workarounds for this vulnerability. It is crucial to apply the patch or upgrade to the fixed version.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:vmware-vrealize-orchestrator.
