CVE-2022-36904

Vulnerability

Details

Jenkins Repository Connector Plugin versions 2.2.0 and earlier contain a missing permission check in a form validation method [1]. This method does not verify that the user has the required permissions before processing a file path check, violating the principle of least privilege.

Exploitation

An attacker with only Overall/Read permission can send a crafted request to the form validation endpoint, specifying an arbitrary file path on the Jenkins controller file system [3]. No additional authentication or network position is required beyond having a Jenkins account with the minimal Read permission.

Impact

Successful exploitation allows the attacker to determine whether a given file path exists on the controller, enabling reconnaissance of the file system [4]. This information disclosure could be used to identify sensitive files or configuration details, potentially aiding further attacks.

Mitigation

The Jenkins Security Advisory 2022-07-27 recommends upgrading to a fixed version of the Repository Connector Plugin [1]. As of the advisory date, no patch was available; users should monitor for updates or consider removing the plugin if not needed.