CVE-2022-34814: Incorrect Authorization in Jenkins Request Rename Or Delete Plugin
Summary
CVE-2022-34814: Incorrect Authorization in Jenkins Request Rename Or Delete Plugin. Affects org.jenkins-ci.plugins:rrod versions < 1.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Request Rename Or Delete Plugin is a Maven package (org.jenkins-ci.plugins:rrod) that provides functionality for renaming or deleting requests in the Jenkins continuous integration and delivery platform. This plugin allows users with appropriate permissions to manage pending requests. However, versions 1.1.0 and earlier of the plugin have an incorrect authorization implementation in an HTTP endpoint. This flaw enables attackers with Overall/Read permission to access an administrative configuration page that lists pending requests.
Vulnerability Detail
The vulnerability (CVE-2022-34814) in the Jenkins Request Rename Or Delete Plugin arises from the lack of proper permission checks in an HTTP endpoint. As a result, users with Overall/Read permission can view an administrative configuration page that displays pending requests. This unauthorized access could lead to the exposure of sensitive information and potentially allow attackers to manipulate or interfere with pending requests. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the administrative configuration page by adjusting the permissions of the affected plugin. Specifically, the Overall/Read permission should be limited to trusted users or revoked entirely for untrusted users. This can be achieved through the Jenkins user interface by modifying the plugin's configuration settings.
Conclusion
The Jenkins Request Rename Or Delete Plugin versions 1.1.0 and earlier suffer from an incorrect authorization vulnerability, allowing users with Overall/Read permission to access an administrative configuration page. To mitigate this issue, it is recommended to upgrade to version 1.1.1 or later. Restricting access to the administrative configuration page through permission adjustments can also serve as a temporary workaround. For further assistance in addressing this vulnerability, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:rrod →
FAQ
The vulnerability allows users with Overall/Read permission to view an administrative configuration page listing pending requests. This could lead to the exposure of sensitive information and potential manipulation of pending requests.
Users of Jenkins Request Rename Or Delete Plugin versions 1.1.0 and earlier are affected by this vulnerability.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability.
The recommended mitigation is to upgrade the plugin to version 1.1.1 or later. Additionally, restricting access to the administrative configuration page by adjusting permissions can serve as a temporary workaround.
For more information about this vulnerability, refer to the GitHub Security Advisory GHSA-qhmj-29vh-8mjm.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:rrod.
