CVE-2022-41230: Missing permission check in Jenkins build-publisher Plugin
Summary
CVE-2022-41230: Missing permission check in Jenkins build-publisher Plugin. Affects org.jenkins-ci.plugins:build-publisher versions < 1.22. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Build-Publisher Plugin is a Maven-based plugin that allows users to publish builds to Jenkins servers. It provides a convenient way to distribute builds and manage their publication. The plugin is widely used in Jenkins environments for build management and deployment tasks.
Vulnerability Detail
The Jenkins Build-Publisher Plugin version 1.22 and earlier has a vulnerability that allows attackers with Overall/Read permission to obtain sensitive information. The plugin does not perform a permission check in an HTTP endpoint, which enables attackers to access names and URLs of Jenkins servers that the plugin is configured to publish builds to. Additionally, attackers can also view builds pending for publication to those Jenkins servers. This vulnerability poses a moderate risk as it can lead to unauthorized access and potential data leakage.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no known workaround for this vulnerability, users are advised to follow the recommended steps mentioned in the 'how_to_fix' section and await an official fix from the Jenkins community.
Conclusion
The Jenkins Build-Publisher Plugin version 1.22 and earlier has a vulnerability that allows attackers with Overall/Read permission to access sensitive information. Currently, there is no known fix or workaround for this vulnerability. Users are advised to monitor official Jenkins channels for updates and apply patches once they are released. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:build-publisher →
FAQ
This vulnerability allows attackers with Overall/Read permission to access sensitive information, including Jenkins server names, URLs, and pending builds. It can potentially lead to unauthorized access and data leakage.
Currently, there is no known fix available for this vulnerability. Users are advised to monitor official Jenkins channels for updates and apply patches once they are released.
Yes, this vulnerability can be exploited remotely by attackers with Overall/Read permission. They can access the vulnerable HTTP endpoint to obtain sensitive information.
As of now, there are no known mitigations for this vulnerability. Users should follow the recommended steps mentioned in the 'how_to_fix' section and await an official fix.
Yes, there are alternative plugins available for build publication in Jenkins. Users can explore other plugins that provide similar functionality and ensure they are regularly updated to address any potential vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:build-publisher.
