CVE-2022-36921: High severity jenkins coverity vulnerability

Q: What is the severity of CVE-2022-36921?

CVE-2022-36921 has a high severity rating due to the potential for unauthorized access and credential theft.

Q: How do I fix CVE-2022-36921?

To fix CVE-2022-36921, update the Jenkins Coverity Plugin to version 1.11.5 or later.

Q: What are the affected versions for CVE-2022-36921?

CVE-2022-36921 affects Jenkins Coverity Plugin versions up to and including 1.11.4.

Q: What is the impact of CVE-2022-36921?

The impact of CVE-2022-36921 includes the possibility of credential leakage and unauthorized access to external systems.

Q: Who is vulnerable to CVE-2022-36921?

Users of Jenkins with the Coverity Plugin installed prior to version 1.11.5 are vulnerable to CVE-2022-36921.

Published Jul 27, 2022

Updated

A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected Software

1 affected component

Jenkins Coverity Jenkins<=1.11.4

Event History

Jul 27, 2022

CVE Published

via MITRE·02:29 PM

Data Sourced

via MITRE·02:29 PM

Description

Frequently Asked Questions

What is the severity of CVE-2022-36921?

CVE-2022-36921 has a high severity rating due to the potential for unauthorized access and credential theft.

How do I fix CVE-2022-36921?

To fix CVE-2022-36921, update the Jenkins Coverity Plugin to version 1.11.5 or later.

What are the affected versions for CVE-2022-36921?

CVE-2022-36921 affects Jenkins Coverity Plugin versions up to and including 1.11.4.

What is the impact of CVE-2022-36921?

The impact of CVE-2022-36921 includes the possibility of credential leakage and unauthorized access to external systems.

Who is vulnerable to CVE-2022-36921?