cbcvebase.
CVE-2022-34785
published 2022-06-30

CVE-2022-34785: Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to…

PriorityP420medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.64%
46.6th percentile
Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them.

Affected

25 ranges
VendorProductVersion rangeFixed in
jenkinsbuild-metrics<= 1.3—
jenkinsbuild_notifications_plugin——
jenkinscisco_spark_plugin——
jenkinsdeployment_dashboard_plugin——
jenkinselasticsearch_query_plugin——
jenkinsfailed_job_deactivator_plugin——
jenkinsfeedback_panel_plugin——
jenkinsgitlab_plugin——
jenkinsids_in_xebialabs_xl_release_plugin——
jenkinsjigomerge_plugin——
jenkinsmatrix_reloaded_plugin——
jenkinsopsgenie_plugin——
jenkinsplot_plugin——
jenkinsproject_inheritance_plugin——
jenkinsrecipe_plugin——
jenkinsrequest_rename_or_delete_plugin——
jenkinsrich_text_publisher_plugin——
jenkinsrocketchat_notifier_plugin——
jenkinsrqm_plugin——
jenkinsskype_notifier_plugin——
jenkinstestng_results_plugin——
jenkinsvalidating_email_parameter_plugin——
jenkinsxebialabs_xl_release_plugin——
jenkinsxpath_configuration_viewer_plugin——
jenkins_projectjenkins_build-metrics_pluginunspecified – 1.3—

CVSS provenance

nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.