CVE-2022-28158

Vulnerability

A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin versions 1.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs. The vulnerability exists in the plugin's HTTP endpoint that exposes credential IDs without proper authorization verification [1][2][3].

Exploitation

An attacker must have at least Overall/Read permission in Jenkins to exploit this vulnerability. No other privileges or user interaction are required. The attacker can simply access the vulnerable HTTP endpoint to retrieve a list of stored credential IDs [1][2].

Impact

Successful exploitation leads to information disclosure, as the attacker can enumerate credentials IDs stored in Jenkins. While the actual credential values are not exposed, knowledge of credential IDs can facilitate further attacks such as exploiting other vulnerabilities that accept credentials IDs as parameters [1][2][3].

Mitigation

No fix has been released for Pipeline: Phoenix AutoTest Plugin as of the publication date. The plugin is listed among unresolved security issues in the Jenkins Security Advisory 2022-03-29. Users should limit access to Jenkins to trusted users only and consider removing the plugin if not required [1][2].