CVE-2022-36903: Jenkins Repository Connector Plugin allows enumeration of credentials IDs
Summary
CVE-2022-36903: Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform permission checks in several HTTP endpoints. Affects org.jenkins-ci.plugins:repository-connector versions < 2.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Repository Connector Plugin is a Maven ecosystem package that provides functionality for connecting to repositories in Jenkins. It allows users to manage and access credentials stored in Jenkins for authentication purposes. This plugin is widely used in Jenkins instances for various development and automation tasks.
Vulnerability Detail
A vulnerability has been discovered in the Jenkins Repository Connector Plugin version 2.2.0 and earlier. Attackers with Overall/Read permission can exploit this vulnerability to enumerate credentials IDs of credentials stored in Jenkins. This means that unauthorized users can gather sensitive information about the credentials used for authentication, potentially leading to further security breaches or unauthorized access to Jenkins resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict the Overall/Read permission to trusted individuals or groups only. By limiting access to this permission, the risk of unauthorized enumeration of credentials IDs can be mitigated. To implement this workaround, administrators can navigate to the Jenkins security settings and modify the permissions accordingly.
Conclusion
The Jenkins Repository Connector Plugin is vulnerable to an enumeration of credentials IDs issue, which can be exploited by attackers with Overall/Read permission. To mitigate this vulnerability, it is crucial to update the plugin to version 2.2.1 or later. Restricting the Overall/Read permission can also serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:repository-connector →
FAQ
The vulnerability allows attackers with Overall/Read permission to gather credentials IDs, potentially leading to unauthorized access or further security breaches in Jenkins.
No, this vulnerability requires attackers to have Overall/Read permission in Jenkins, which typically requires authenticated access.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
Yes, the CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
Yes, the Jenkins Repository Connector Plugin has released version 2.2.1, which includes a fix for this vulnerability. It is recommended to update to this version or later.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:repository-connector.
