CVE-2022-34779

Vulnerability

Description CVE-2022-34779 is a missing permission check in the Jenkins XebiaLabs XL Release Plugin versions 22.0.0 and earlier. The plugin fails to properly verify permissions when accessing a certain endpoint, allowing users with only Overall/Read permission to enumerate credentials IDs of stored credentials [1][3].

Exploitation

An attacker needs Overall/Read permission, which is typically granted to low-privileged users or can be obtained through other means. The attacker can exploit this by sending a crafted request to the vulnerable endpoint, without needing any further authorization [1]. No special network position is required beyond access to the Jenkins instance.

Impact

Successful exploitation allows an attacker to retrieve a list of credential IDs stored in Jenkins. While credential IDs alone do not expose the secret values, they can be used in further attacks, such as cross-site request forgery or credential reuse, to potentially compromise the Jenkins environment [1][3].

Mitigation

The vulnerability is fixed in XebiaLabs XL Release Plugin version 22.0.1 or later. Users should upgrade to the latest version. As a workaround, administrators can restrict Overall/Read permission to trusted users only [1].