CVE-2022-30952

CWE-522 — Insufficiently Protected CredentialsCWE-12206 documents6 sources
Severity
6.5MEDIUM
EPSS
0.4%
top 40.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Pipeline SCM API FOR Blue Ocean PluginJenkins Blue Ocean
Timeline
PublishedMay 17
Latest updateMay 18

Description

Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDjenkins/blue_ocean1.25.3

🔴Vulnerability Details

3
GHSA
Insufficiently Protected Credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin↗2022-05-18
▶
OSV
Insufficiently Protected Credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin↗2022-05-18
▶
CVEList
CVE-2022-30952: Jenkins Pipeline SCM API for Blue Ocean Plugin 1↗2022-05-17
▶

📋Vendor Advisories

2
Jenkins
Jenkins Security Advisory 2022-05-17↗2022-05-17
▶
Red Hat
plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin↗2022-05-17
▶
CVE-2022-30952 (MEDIUM CVSS 6.5) | Jenkins Pipeline SCM API for Blue O | cvebase.io