CVE-2022-34813: Missing Authorization in Jenkins XPath Configuration Viewer Plugin
Summary
CVE-2022-34813: Jenkins XPath Configuration Viewer Plugin Missing Authorization vulnerability. Affects org.jenkins-ci.plugins:xpath-config-viewer versions < 1.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins XPath Configuration Viewer Plugin is a Maven-based package that provides functionality for viewing and managing XPath expressions in Jenkins. It allows users with Overall/Read permission to create and delete XPath expressions. However, a missing permission check in versions 1.1.1 and earlier exposes a vulnerability.
Vulnerability Detail
The vulnerability (CVE-2022-34813) arises from the absence of an authorization check in the Jenkins XPath Configuration Viewer Plugin. Attackers with Overall/Read permission can exploit this flaw to create and delete XPath expressions. This could lead to unauthorized access, data manipulation, or disruption of the Jenkins environment.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators can revoke Overall/Read permission from users who do not require it. This will limit the potential attack surface and mitigate the risk of unauthorized XPath expression manipulation.
Conclusion
The missing authorization vulnerability in the Jenkins XPath Configuration Viewer Plugin (CVE-2022-34813) allows attackers with Overall/Read permission to create and delete XPath expressions. Upgrading to version 1.1.2 or later is recommended to fix this issue. Administrators can also temporarily mitigate the risk by revoking unnecessary permissions. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:xpath-config-viewer →
FAQ
The vulnerability allows attackers with Overall/Read permission to create and delete XPath expressions, potentially leading to unauthorized access, data manipulation, or disruption of the Jenkins environment.
Users of Jenkins XPath Configuration Viewer Plugin versions 1.1.1 and earlier are affected by this vulnerability.
Yes, upgrading to version 1.1.2 or later of the Jenkins XPath Configuration Viewer Plugin fixes this vulnerability.
Administrators can temporarily revoke Overall/Read permission from users who do not require it to reduce the attack surface.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-3fj7-78h2-w98x/GHSA-3fj7-78h2-w98x.json
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:xpath-config-viewer.
