CVE-2022-45394: Missing permission check in Jenkins Delete log Plugin
Summary
CVE-2022-45394: Missing permission check in Jenkins Delete log Plugin. Affects org.jenkins-ci.plugins:delete-log-plugin versions < 1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Delete log Plugin is a Maven package (org.jenkins-ci.plugins:delete-log-plugin) that provides functionality for deleting build logs in the Jenkins automation server. It allows users with appropriate permissions to manage and maintain build logs. However, a vulnerability has been identified in versions 1.0 and earlier of the plugin, which allows attackers with Item/Read permission to delete build logs.
Vulnerability Detail
The vulnerability (CVE-2022-45394) in the Jenkins Delete log Plugin arises from a missing permission check. Attackers with Item/Read permission can exploit this vulnerability to delete build logs. This can lead to the loss of valuable information and hinder the debugging and analysis of build processes. As of the publication of this advisory, no fix has been released for this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is advised to closely monitor the Jenkins environment and restrict Item/Read permissions to trusted users until a fix is available.
Conclusion
The Jenkins Delete log Plugin version 1.0 and earlier is vulnerable to an exploit that allows attackers with Item/Read permission to delete build logs. This can result in the loss of valuable information and hinder the debugging and analysis of build processes. It is recommended to regularly check for updates and apply them promptly once a fix becomes available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:delete-log-plugin →
FAQ
The vulnerability allows attackers with Item/Read permission to delete build logs in Jenkins. This can result in the loss of valuable information and hinder the debugging and analysis of build processes.
Users of Jenkins Delete log Plugin versions 1.0 and earlier are affected by this vulnerability.
As of the publication of this advisory, there is no fix available for this vulnerability. Users are advised to regularly check for updates and apply them promptly once a fix is released.
Currently, there is no known workaround for this vulnerability. It is recommended to closely monitor the Jenkins environment and restrict Item/Read permissions to trusted users until a fix is available.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Jenkins environment is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:delete-log-plugin.
