CVE-2022-20618
First published: Wed Jan 12 2022(Updated: )
A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Bitbucket Branch Source | <=2.9.10 | |
| Jenkins Bitbucket Branch Source | =737.vdf9dc06105be | |
| maven/org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source | <2.9.7.2 | 2.9.7.2 |
| maven/org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source | >=2.9.8<2.9.11.2 | 2.9.11.2 |
| maven/org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source | >=720.vbe985dd73d66<725.vd9f8be0fa250 | 725.vd9f8be0fa250 |
| maven/org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source | >=726.v7e6f53de133c<746.v350d2781c184 | 746.v350d2781c184 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2022/01/12/6
- https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2033
- https://nvd.nist.gov/vuln/detail/CVE-2022-20618
- https://github.com/CVEProject/cvelist/blob/2d78eb36f4d084db7fb35f1535d8d84fdcb7d859/2022/20xxx/CVE-2022-20618.json
- https://github.com/jenkinsci/bitbucket-branch-source-plugin/commit/467ed6c94af8735c4755d53145a54325ae82d073
- https://github.com/advisories/GHSA-w2mh-6xj5-f77f (Advisory)
Frequently Asked Questions
What is the severity of CVE-2022-20618?
The severity of CVE-2022-20618 is rated as medium with a CVSS score of 4.3.
How can I fix CVE-2022-20618?
To fix CVE-2022-20618, upgrade Jenkins Bitbucket Branch Source Plugin to version 746.v350d2781c184 or later.
What endpoints are affected by CVE-2022-20618 in Jenkins Bitbucket Branch Source Plugin?
Several HTTP endpoints in Jenkins Bitbucket Branch Source Plugin are affected by CVE-2022-20618, where permission checks are not performed.
What can attackers with Overall/Read access do in relation to CVE-2022-20618?
Attackers with Overall/Read access can enumerate credential IDs of credentials stored in Jenkins due to the vulnerability in CVE-2022-20618.
- collector/nvd-index
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-w2mh-6xj5-f77f
- alias/CVE-2022-20618
- collector/nvd-cve
- collector/github-advisory
- agent/type
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/references
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- vendor/jenkins
- canonical/jenkins bitbucket branch source
- version/jenkins bitbucket branch source/2.9.10
- version/jenkins bitbucket branch source/737.vdf9dc06105be
- package-manager/maven