CVE-2022-34818

Vulnerability

The Jenkins Failed Job Deactivator Plugin, versions 1.2.1 and earlier, fails to perform permission checks in several views and HTTP endpoints ([1], [2]). This missing access control allows any authenticated user with the Overall/Read permission to trigger job deactivation actions that should require higher privileges.

Exploitation

The attack vector is straightforward: an attacker who has obtained the Overall/Read permission (a relatively low-privilege level in Jenkins) can exploit these unprotected endpoints to disable jobs without needing job-specific permissions. The plugin’s own description notes its purpose is to detect and deactivate or delete orphaned jobs, but the vulnerability means these powerful operations are not gated properly ([3]).

Impact

Successful exploitation results in denial of service or disruption of automated build pipelines, as jobs can be disabled arbitrarily. This can lead to missed builds, delayed deployments, and increased manual intervention to restore job functionality.

Mitigation

The plugin is open source and maintained on GitHub ([3]). The Jenkins Security Advisory 2022-06-30 recommends upgrading to a fixed version where all views and endpoints enforce proper permission checks ([1]).