CVE-2022-36891: Medium severity jenkins deployer framework vulnerability
A missing permission check in Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier allows attackers with Item/Read permission but without Deploy Now/Deploy permission to read deployment logs.
Other sources
Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Item/Read permission to read deployment logs.
Deployer Framework Plugin 86.v7ba4a55bf3ec requires Deploy Now/Deploy permission to read deployment logs.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-36891?
CVE-2022-36891 has a medium severity due to the potential exposure of deployment logs to unauthorized users.
How do I fix CVE-2022-36891?
To fix CVE-2022-36891, upgrade to Jenkins Deployer Framework Plugin version 86.v7b_a_4a_55b_f3ec or later.
What types of permissions are affected by CVE-2022-36891?
CVE-2022-36891 allows users with Item/Read permission to access deployment logs without having Deploy Now/Deploy permission.
What versions of the Jenkins Deployer Framework Plugin are impacted by CVE-2022-36891?
CVE-2022-36891 affects versions up to and including 85.v1d1888e8c021 of the Jenkins Deployer Framework Plugin.
What is the main issue caused by CVE-2022-36891?
The main issue caused by CVE-2022-36891 is the missing permission check that exposes sensitive deployment logs to unauthorized users.