CVE-2022-36910

CWE-862 — Missing Authorization5 documents5 sources
Severity
5.4MEDIUM
EPSS
0.3%
top 47.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Lucene-search PluginJenkins Lucene-search
Timeline
PublishedJul 27
Latest updateJul 28

Description

Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages3 packages

▶CVEListV5jenkins_project/jenkins_lucene-search_pluginunspecified — 370.v62a5f618cd3a
▶NVDjenkins/lucene-search370.v62a5f618cd3a

🔴Vulnerability Details

3
GHSA
Lucene-Search Plugin does not perform permission checks in several HTTP endpoints↗2022-07-28
▶
OSV
Lucene-Search Plugin does not perform permission checks in several HTTP endpoints↗2022-07-28
▶
CVEList
CVE-2022-36910: Jenkins Lucene-Search Plugin 370↗2022-07-27
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2022-07-27↗2022-07-27
▶
CVE-2022-36910 (MEDIUM CVSS 5.4) | Jenkins Lucene-Search Plugin 370.v6 | cvebase.io