CVE-2022-34818: Missing Authorization in Jenkins Failed Job Deactivator Plugin
Summary
CVE-2022-34818: Jenkins Failed Job Deactivator Plugin Missing Authorization vulnerability. Affects de.einsundeins.jenkins.plugins.failedjobdeactivator:failedJobDeactivator versions < 1.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Failed Job Deactivator Plugin is a Maven package (de.einsundeins.jenkins.plugins.failedjobdeactivator:failedJobDeactivator) used in Jenkins, an open-source automation server. This plugin allows users to disable failed jobs. It is vulnerable to a missing authorization issue, where permission checks are not performed in certain views and HTTP endpoints. This vulnerability can be exploited by attackers with Overall/Read permission to disable jobs.
Vulnerability Detail
The missing authorization vulnerability in the Jenkins Failed Job Deactivator Plugin allows attackers with Overall/Read permission to disable jobs without proper permission checks. This can lead to unauthorized job deactivation and potential disruption of the Jenkins automation process. The vulnerability has a CVSS score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-862.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict the Overall/Read permission to trusted individuals only. This can be done by modifying the Jenkins access control configuration to limit access to the Overall/Read permission. However, this workaround may limit the visibility of job status to authorized users.
Conclusion
The Jenkins Failed Job Deactivator Plugin is vulnerable to a missing authorization issue that allows attackers with Overall/Read permission to disable jobs without proper permission checks. To mitigate this vulnerability, it is recommended to upgrade to the latest version of the plugin and apply the necessary permission checks. Users can also use the Vulert Playground to check if their Jenkins installation is affected. For further support, contact DevNack.com.
See every vulnerability recorded for de.einsundeins.jenkins.plugins.failedjobdeactivator:failedJobDeactivator →
FAQ
The vulnerability allows attackers with Overall/Read permission to disable jobs without proper authorization. This can disrupt the Jenkins automation process and potentially lead to unauthorized changes in job status.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using the pom.xml file.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to apply the recommended fix to prevent potential exploitation.
As a temporary workaround, you can restrict the Overall/Read permission to trusted individuals only. However, it is strongly recommended to upgrade to the latest version of the Jenkins Failed Job Deactivator Plugin to fully address the vulnerability.
For further support on vulnerability remediation and assistance with Jenkins security, you can contact info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for de.einsundeins.jenkins.plugins.failedjobdeactivator:failedJobDeactivator.
