CVE-2022-36903: Medium severity jenkins repository connector vulnerability
A missing permission check in Jenkins Repository Connector Plugin 2.2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Other sources
Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform permission checks in several HTTP endpoints.
This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.
As of publication of this advisory, there is no fix.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-36903?
CVE-2022-36903 is rated as a high severity vulnerability due to its potential to allow unauthorized access to sensitive credential information.
How do I fix CVE-2022-36903?
To fix CVE-2022-36903, upgrade the Jenkins Repository Connector Plugin to version 2.2.1 or later where the permission checks have been properly implemented.
What types of attacks can be executed due to CVE-2022-36903?
Attackers can exploit CVE-2022-36903 to enumerate credential IDs without proper permissions, leading to potential credential exposure.
What versions of Jenkins are affected by CVE-2022-36903?
CVE-2022-36903 affects Jenkins Repository Connector Plugin versions up to and including 2.2.0.
Who is at risk from CVE-2022-36903?
Users of Jenkins with Overall/Read permission are at risk from CVE-2022-36903 as it allows them to access sensitive data.