CVE-2022-30957

A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Published: May 17, 2022
Updated: May 9, 2024
CVE: CVE-2022-30957
GHSA: GHSA-x454-72fx-69q3
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 4.3
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS v2:

Severity: Low
Score: 4
AV:N/AC:L/Au:S/C:P/I:N/A:N

CWEs:

CWE-862

Affected Software
References

Software	From	Fixed in
jenkins / ssh	-	2.6.1.x
org.jenkins-ci.plugins / ssh	-	2.6.1.x

http://www.openwall.com/lists/oss-security/2022/05/17/8
https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2315

Vulnerability Database

289,599

CVE-2022-30957