CVE-2022-36904: Medium severity jenkins repository connector vulnerability
Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Other sources
Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation.
This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. A sequence of requests can be used to effectively list the Jenkins controller file system.
As of publication of this advisory, there is no fix.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-36904?
CVE-2022-36904 is classified as medium severity due to the potential for information disclosure.
How do I fix CVE-2022-36904?
To fix CVE-2022-36904, update the Jenkins Repository Connector Plugin to version 2.2.1 or later.
What is the impact of CVE-2022-36904?
The impact of CVE-2022-36904 allows attackers with Overall/Read permission to access file paths on the Jenkins controller.
Who is affected by CVE-2022-36904?
CVE-2022-36904 affects Jenkins Repository Connector Plugin versions 2.2.0 and earlier.
What type of vulnerability is CVE-2022-36904?
CVE-2022-36904 is a permission validation issue related to form validation within the Jenkins Repository Connector Plugin.