CVE-2022-34796
Description
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier lacks a permission check, allowing attackers with Overall/Read to enumerate credential IDs.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier lacks a permission check, allowing attackers with Overall/Read to enumerate credential IDs.
Vulnerability
Description
The Jenkins Deployment Dashboard Plugin up to version 1.0.10 fails to perform a permission check in a method implementing form validation. This missing check allows users with only Overall/Read permission to access a function that should require higher privileges. [1]
Exploitation
An attacker with Overall/Read permission (typically granted to many users) can exploit this flaw by sending a crafted request to the affected form validation endpoint. No further authentication is needed beyond the existing Jenkins credentials. [2]
Impact
Successful exploitation enables the attacker to enumerate the IDs of credentials stored in Jenkins. While the actual credential values are not exposed, credential IDs can provide valuable information about the credential types and names, aiding in further attacks. [3]
Mitigation
The issue is fixed in Deployment Dashboard Plugin version 1.0.11. Users should upgrade to this version or later as soon as possible. No workaround is available. [1]
AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:ec2-deployment-dashboardMaven | <= 1.0.10 | — |
Affected products
2- Range: unspecified
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/advisories/GHSA-5mxg-p5qh-2gchghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-34796ghsaADVISORY
- www.jenkins.io/security/advisory/2022-06-30/ghsax_refsource_CONFIRMWEB
- www.jenkins.io/security/advisory/2022-06-30/ghsaWEB
News mentions
0No linked articles in our index yet.