CVE-2022-36913: Medium severity openstack heat vulnerability
Jenkins Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Other sources
Jenkins openstack-heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation.
This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. A sequence of requests can be used to effectively list the Jenkins controller file system.
As of publication of this advisory, there is no fix.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-36913?
CVE-2022-36913 has a medium severity rating due to improper permission checks in the Jenkins OpenStack Heat Plugin.
How do I fix CVE-2022-36913?
To fix CVE-2022-36913, update the Jenkins OpenStack Heat Plugin to version 1.6 or later.
Who is affected by CVE-2022-36913?
CVE-2022-36913 affects users of Jenkins OpenStack Heat Plugin versions 1.5 and earlier.
What is the impact of CVE-2022-36913?
The impact of CVE-2022-36913 allows attackers with Overall/Read permission to check for the existence of arbitrary file paths on the Jenkins controller.
Is CVE-2022-36913 being actively exploited?
As of now, CVE-2022-36913 has not been reported to be actively exploited in the wild.