CVE-2022-34796: Insufficiently Protected Credentials in Jenkins Deployment Dashboard Plugin
Summary
CVE-2022-34796: Jenkins Deployment Dashboard Plugin has Insufficiently Protected Credentials. Affects org.jenkins-ci.plugins:ec2-deployment-dashboard versions < 1.0.10. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Deployment Dashboard Plugin is a Maven package (org.jenkins-ci.plugins:ec2-deployment-dashboard) that provides a dashboard for managing deployments in Jenkins. It allows users to monitor and control deployments of applications to Amazon EC2 instances. The plugin is widely used in Jenkins environments for managing deployment processes.
Vulnerability Detail
The Jenkins Deployment Dashboard Plugin version 1.0.10 and earlier suffer from an insufficiently protected credentials vulnerability. This vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. By exploiting this vulnerability, an attacker can gain unauthorized access to sensitive information, such as access keys, passwords, or tokens, stored in Jenkins. This can lead to further compromise of the Jenkins environment and potential unauthorized access to other systems or resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading the Jenkins Deployment Dashboard Plugin to the latest version.
Conclusion
The Jenkins Deployment Dashboard Plugin version 1.0.10 and earlier are vulnerable to an insufficiently protected credentials issue. This vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins, potentially leading to unauthorized access to sensitive information. Users should upgrade to version 1.0.11 or later to fix this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:ec2-deployment-dashboard →
FAQ
This vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. This can lead to unauthorized access to sensitive information and potential compromise of the Jenkins environment.
Users of Jenkins Deployment Dashboard Plugin versions 1.0.10 and earlier are affected by this vulnerability.
There are no known exploits for this vulnerability at the time of this advisory.
Yes, a fix is available in version 1.0.11 of the Jenkins Deployment Dashboard Plugin. Users should upgrade to this version to mitigate the vulnerability.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:ec2-deployment-dashboard.
