CVE-2022-30955: Medium severity jenkins gitlab vulnerability
Published May 17, 2022
·Updated
Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Affected Software
2 affected componentsFixes available
maven/org.jenkins-ci.plugins:gitlab-plugin<1.5.32
1.5.32
Jenkins Gitlab Jenkins<=1.5.31
Event History
May 17, 2022
CVE Published
via MITRE·02:06 PM
Data Sourced
via MITRE·02:06 PM
Description
May 18, 2022
Advisory Published
12:00 AM
Frequently Asked Questions
1
What is the severity of CVE-2022-30955?
CVE-2022-30955 has a moderate severity rating due to the potential for credential ID enumeration.
2
How do I fix CVE-2022-30955?
To fix CVE-2022-30955, upgrade the Jenkins GitLab Plugin to version 1.5.32 or later.
3
What is the impact of CVE-2022-30955?
The impact of CVE-2022-30955 allows unauthorized users with Overall/Read permission to enumerate stored credential IDs in Jenkins.
4
Is CVE-2022-30955 present in all versions of the Jenkins GitLab Plugin?
CVE-2022-30955 is present in Jenkins GitLab Plugin version 1.5.31 and earlier.
5
What can attackers do with CVE-2022-30955?
Attackers can exploit CVE-2022-30955 to obtain a list of credential IDs stored within Jenkins, potentially leading to further exploitation.