CVE-2022-34796: Medium severity jenkins deployment dashboard plugin vulnerability
A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Other sources
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform permission checks in several HTTP endpoints.
This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.
As of publication of this advisory, there is no fix.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for Jenkins Deployment Dashboard Plugin?
The vulnerability ID for Jenkins Deployment Dashboard Plugin is CVE-2022-34796.
What is the severity level of CVE-2022-34796?
CVE-2022-34796 has a severity level of medium with a value of 4.3.
How does CVE-2022-34796 affect Jenkins Deployment Dashboard Plugin?
CVE-2022-34796 allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
What is the affected version of Jenkins Deployment Dashboard Plugin?
Jenkins Deployment Dashboard Plugin versions up to and including 1.0.10 are affected.
How can I fix CVE-2022-34796 in Jenkins Deployment Dashboard Plugin?
To fix CVE-2022-34796 in Jenkins Deployment Dashboard Plugin, upgrade to a version beyond 1.0.10.