CVE-2022-36898: Medium severity jenkins compuware ispw operations vulnerability
A missing permission check in Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins.
Other sources
Jenkins BMC AMI DevX Code Pipeline Operations Plugin 1.0.8 and earlier does not perform permission checks in several HTTP endpoints.
This allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins. Those credentials IDs can be used as part of an attack to capture the credentials using another vulnerability.
BMC AMI DevX Code Pipeline Operations Plugin 1.0.9 requires the appropriate permissions to enumerate hosts and ports of Compuware configurations and credentials IDs.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-36898?
CVE-2022-36898 is a vulnerability in Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier that allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins.
How severe is CVE-2022-36898?
CVE-2022-36898 has a severity score of 4.3, which is considered medium.
Which software versions are affected by CVE-2022-36898?
Jenkins Compuware ISPW Operations Plugin versions up to and including 1.0.8 and Jenkins BMC AMI DevX Code Pipeline Operations Plugin versions up to and including 1.0.8 are affected by CVE-2022-36898.
How can the missing permission check vulnerability in Jenkins Compuware ISPW Operations Plugin be fixed?
To fix the missing permission check vulnerability in Jenkins Compuware ISPW Operations Plugin, you should update to version 1.0.9 or later.
Where can I find more information about CVE-2022-36898?
You can find more information about CVE-2022-36898 on the Openwall, Jenkins, and NIST websites.