CVE-2022-34782: Incorrect Authorization in Jenkins requests-plugin
Summary
CVE-2022-34782: Incorrect Authorization in Jenkins requests-plugin. Affects org.jenkins-ci.plugins:requests versions < 2.2.17. Fixed in 2.2.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins requests-plugin is a plugin that allows users to create and manage HTTP requests within Jenkins. It provides functionality for sending HTTP requests and handling responses. The plugin is commonly used in Jenkins environments to automate various tasks that involve making HTTP requests. However, versions 2.2.16 and earlier of the requests-plugin are vulnerable to an incorrect authorization issue.
Vulnerability Detail
The vulnerability in the requests-plugin (versions 2.2.16 and earlier) allows attackers with Overall/Read permission to view the list of pending requests. This permission check is incorrect and can be exploited by unauthorized users. The vulnerability was initially addressed in a previous fix (SECURITY-1995), but the fix was ineffective. The issue was finally resolved in version 2.2.17 of the plugin, which now requires Overall/Administer permission to view the list of pending requests. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.2.17
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of the requests-plugin.
Conclusion
The Jenkins requests-plugin versions 2.2.16 and earlier are vulnerable to an incorrect authorization issue, allowing unauthorized users to view the list of pending requests. This vulnerability has been fixed in version 2.2.17 of the plugin, which requires Overall/Administer permission for access. It is recommended to upgrade to the fixed version to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:requests →
FAQ
The vulnerability allows unauthorized users with Overall/Read permission to view the list of pending requests in Jenkins. This could potentially expose sensitive information and compromise the security of the Jenkins environment.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins environment is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
Yes, the vulnerability has been fixed in version 2.2.17 of the requests-plugin. It is recommended to upgrade to this version to mitigate the vulnerability.
Attackers with Overall/Read permission can exploit this vulnerability to view the list of pending requests. However, the fixed version (2.2.17) now requires Overall/Administer permission to access the list.
There are no known instances of this vulnerability being actively exploited at the moment. However, it is important to apply the fix to prevent any potential unauthorized access.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:requests.
