CVE-2022-25206: High severity jenkins vulnerability
Published Feb 15, 2022
·Updated
A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified database via JDBC using attacker-specified credentials.
Affected Software
2 affected components
maven/org.jenkins-ci.plugins:dbCharts<=0.5.2
Jenkins Dbcharts Jenkins<=0.5.2
Remediation
Event History
Feb 15, 2022
CVE Published
via MITRE·04:11 PM
Data Sourced
via MITRE·04:11 PM
Description
Feb 16, 2022
Advisory Published
12:01 AM
Frequently Asked Questions
1
What is the severity of CVE-2022-25206?
CVE-2022-25206 is considered a critical vulnerability due to the potential for unauthorized database access.
2
How do I fix CVE-2022-25206?
To mitigate CVE-2022-25206, upgrade the Jenkins dbCharts Plugin to version 0.5.3 or later.
3
Who is affected by CVE-2022-25206?
Users of Jenkins dbCharts Plugin version 0.5.2 and earlier are vulnerable to CVE-2022-25206.
4
What type of vulnerability is CVE-2022-25206?
CVE-2022-25206 is a security vulnerability that allows attackers to connect to any database using JDBC with custom credentials.
5
What permissions are required to exploit CVE-2022-25206?
An attacker requires Overall/Read permission in Jenkins to exploit CVE-2022-25206.