CVE-2022-36919: Medium severity jenkins coverity vulnerability
A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Other sources
Jenkins Coverity Plugin 1.11.4 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.
As of publication of this advisory, there is no fix.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-36919?
CVE-2022-36919 is classified as a medium severity vulnerability.
How do I fix CVE-2022-36919?
To fix CVE-2022-36919, upgrade to Jenkins Coverity Plugin version 1.11.5 or later.
What impact does CVE-2022-36919 have on Jenkins?
CVE-2022-36919 allows unauthorized users with Overall/Read permission to enumerate credential IDs stored in Jenkins.
Which versions of the Jenkins Coverity Plugin are affected by CVE-2022-36919?
Versions 1.11.4 and earlier of the Jenkins Coverity Plugin are affected by CVE-2022-36919.
What is the vulnerability description of CVE-2022-36919?
CVE-2022-36919 involves a missing permission check that enables credential ID enumeration by attackers with insufficient privileges.