Back to feed
EUVD-2022-4521 · Published May 24, 2022
Jenkins ElectricFlow Plugin Missing permission checks Various form validation and form autocompletion methods in CloudBees CD Plugin lacked permission checks. This allowed attackers with Overall/Read access to obtain information about the configuration of CloudBees CD Plugin, as well as the configuration and data of connected ElectricFlow servers. These form validation and autocompletion methods now require Overall/Administer or Job/Configure permission, as appropriate for the given method.
Technologies
Jenkins Electricflow
Weaknesses
CWE-862
CVSS scores
- v3.04.3
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access Persistence Stealth Defense Impairment Credential Access
References
- http://www.openwall.com/lists/oss-security/2019/06/11/1
- http://www.securityfocus.com/bid/108747
- https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1410%20%282%29
- https://nvd.nist.gov/vuln/detail/CVE-2019-10333
- https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1410%20(2)
- https://web.archive.org/web/20200227033720/http://www.securityfocus.com/bid/108747
Potentially impacted assets
See if this affects your attack surface
