What is GHSA-52v4-wxrx-gjjm?

GHSA-52v4-wxrx-gjjm is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins Apprenda Plugin has Missing Authorization vulnerability

Which CVE IDs does GHSA-52v4-wxrx-gjjm cover?

GHSA-52v4-wxrx-gjjm covers the following CVE IDs: CVE-2022-41251. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-52v4-wxrx-gjjm?

GHSA-52v4-wxrx-gjjm has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-52v4-wxrx-gjjm?

GHSA-52v4-wxrx-gjjm affects 1 product, including: maven/org.jenkins-ci.plugins:apprenda:\u003c= 2.2.0.

GHSA-52v4-wxrx-gjjmMediumCVSS 4.3

Jenkins Apprenda Plugin has Missing Authorization vulnerability

Vendor

GitHub Security Advisories

Published

September 22, 2022

Last Modified

October 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-41251 →

📋 Description

Jenkins Apprenda Plugin 2.2.0 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

As of publication of this advisory, there is no fix.

🎯 Affected products1

maven/org.jenkins-ci.plugins:apprenda:<= 2.2.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-41251
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2710
http://www.openwall.com/lists/oss-security/2022/09/21/5
https://github.com/advisories/GHSA-52v4-wxrx-gjjm