CVE-2022-34180: Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for…

PriorityP341high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EPSS

1.26%

69.4th percentile

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotected" status badge access, allowing attackers without any permissions to obtain the build status badge icon for any attacker-specified job and/or build.

Affected

32 ranges· showing 25

Vendor	Product	Version range	Fixed in
jenkins	agent_server_parameter_plugin	—	—
jenkins	beaker_builder_plugin	—	—
jenkins	convertigo_mobile_platform_plugin	—	—
jenkins	crx_content_package_deployer_plugin	—	—
jenkins	date_parameter_plugin	—	—
jenkins	dynamic_extended_choice_parameter_plugin	—	—
jenkins	easyqa_plugin	—	—
jenkins	embeddable_build_status	<= 2.0.3	—
jenkins	embeddable_build_status_plugin	—	—
jenkins	filesystem_list_parameter_plugin	—	—
jenkins	hidden_parameter_plugin	—	—
jenkins	image_tag_parameter_plugin	—	—
jenkins	improper_authorization_in_embeddable_build_status_plugin	—	—
jenkins	input_step_plugin	—	—
jenkins	jenkins_ci_server_plugin	—	—
jenkins	jenkins_core	—	—
jenkins	jenkins_lts	—	—
jenkins	jenkins_weekly	—	—
jenkins	jianliao_notification_plugin	—	—
jenkins	junit_plugin	—	—
jenkins	maven_metadata_plugin	—	—
jenkins	nested_view_plugin	—	—
jenkins	ns-nd_integration_performance_publisher_plugin	—	—
jenkins	orchestrator_plugin	—	—
jenkins	package_version_plugin	—	—

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.