CVE-2022-34779: XebiaLabs XL Release Plugin - Missing Permission Checks Allow Enumeration of Credentials IDs
Summary
CVE-2022-34779: Missing permission checks in Jenkins XebiaLabs XL Release Plugin allow enumerating credentials IDs. Affects com.xebialabs.ci:xlrelease-plugin versions < 22.0.1. Fixed in 22.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The XebiaLabs XL Release Plugin is a Maven package (com.xebialabs.ci:xlrelease-plugin) that integrates with Jenkins to provide release management capabilities. It allows users to define and manage release pipelines, deploy applications, and automate release processes. The plugin is widely used in software development and deployment workflows.
Vulnerability Detail
The XebiaLabs XL Release Plugin version 22.0.0 and earlier has a vulnerability that allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. This vulnerability arises due to missing permission checks in several HTTP endpoints. By enumerating the credentials IDs, an attacker can gather sensitive information that can be used in further attacks to capture the credentials using another vulnerability. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
22.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. However, administrators can mitigate the risk by ensuring that only trusted users have Overall/Read permission in Jenkins. Additionally, monitoring and auditing the usage of credentials within the Jenkins environment can help detect any unauthorized access or misuse.
Conclusion
The XebiaLabs XL Release Plugin version 22.0.0 and earlier is vulnerable to an enumeration of credentials IDs, allowing attackers with Overall/Read permission to gather sensitive information. Upgrading to version 22.0.1 or later is recommended to fix this vulnerability. Administrators should also ensure proper permission management and monitoring of credentials usage in Jenkins. For further support and information, contact DevNack.com.
See every vulnerability recorded for com.xebialabs.ci:xlrelease-plugin →
FAQ
The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs, potentially leading to unauthorized access to sensitive information stored in Jenkins.
No, this vulnerability requires authenticated access to Jenkins with Overall/Read permission. It cannot be exploited remotely without valid credentials.
There are no known instances of this vulnerability being exploited in the wild. However, it is important to apply the recommended fix to prevent any potential misuse of the vulnerability.
Yes, the CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
For more information and assistance in vulnerability remediation, you can reach out to info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for com.xebialabs.ci:xlrelease-plugin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
