CVE-2022-45383: Incorrect permission checks in Jenkins Support Core Plugin
Summary
CVE-2022-45383: Incorrect permission checks in Jenkins Support Core Plugin. Affects org.jenkins-ci.plugins:support-core versions < 1206.1208.v9b_7a_1d48db_0f. Fixed in 1206.1208.v9b_7a_1d48db_0f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Support Core Plugin is a component of the Jenkins automation server that provides support and diagnostic features. It includes the Support/DownloadBundle permission, which allows users to create and download support bundles containing diagnostic information. However, versions 1206.v14049fa_b_d860 and earlier of the Support Core Plugin have incorrect permission checks in several HTTP endpoints. This vulnerability allows attackers with the Support/DownloadBundle permission to download support bundles that contain information limited to users with Overall/Administer permission. The Support Core Plugin version 1206.1208.v9b_7a_1d48db_0f deprecates the Support/DownloadBundle permission and requires the Overall/Administer permission to download support bundles.
Vulnerability Detail
The vulnerability in the Jenkins Support Core Plugin arises from the incorrect permission checks in various HTTP endpoints. Attackers with the Support/DownloadBundle permission can exploit this flaw to download support bundles that contain sensitive information limited to users with Overall/Administer permission. This can lead to unauthorized access to diagnostic information and potentially expose sensitive data. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Latest published version: 1865.v45d40b_778b_cb_ as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1206.1208.v9b_7a_1d48db_0f
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and upgrade to the latest version of the Jenkins Support Core Plugin.
Conclusion
The Jenkins Support Core Plugin has a vulnerability that allows attackers with the Support/DownloadBundle permission to download support bundles containing sensitive diagnostic information. To mitigate this risk, it is recommended to upgrade to version 1206.1208.v9b_7a_1d48db_0f or later, which deprecates the vulnerable permission and requires the Overall/Administer permission for downloading support bundles. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:support-core →
FAQ
The vulnerability allows attackers with the Support/DownloadBundle permission to download support bundles containing sensitive diagnostic information. This can lead to unauthorized access to data that should be limited to users with Overall/Administer permission.
Versions 1206.v14049fa_b_d860 and earlier of the Jenkins Support Core Plugin are affected by this vulnerability.
The recommended solution is to upgrade to version 1206.1208.v9b_7a_1d48db_0f or later of the Jenkins Support Core Plugin, which deprecates the Support/DownloadBundle permission and requires the Overall/Administer permission to download support bundles.
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and upgrade to the latest version of the Jenkins Support Core Plugin.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:support-core.
