CVE-2022-41251

Vulnerability

Description CVE-2022-41251 is a missing permission check in Jenkins Apprenda Plugin versions 2.2.0 and earlier. The plugin fails to verify appropriate permissions when listing credentials, allowing unauthorized users to view credential IDs. This vulnerability is classified with a CVSS score of 4.3 (medium) due to the low attack complexity and network-based attack vector, but it requires authentication with Overall/Read permission [1][2].

Exploitation

An attacker with at least Overall/Read permission in Jenkins can exploit this flaw by accessing credential-related endpoints or UI components that expose credential IDs. No special privileges beyond this low-level permission are needed, making it exploitable by users with minimal access rights. The attack does not require any user interaction and can be performed over the network [1][4].

Impact

Successful exploitation allows an attacker to enumerate credential IDs stored in Jenkins. While this does not reveal the actual secret values, knowing credential IDs can aid in further attacks, such as targeting specific credentials or exploiting other vulnerabilities that require credential ID input. This information disclosure may escalate the impact of other flaws [1][2].

Mitigation

As of the advisory publication date (2022-09-21), the Apprenda Plugin remains affected with no official patch available. The Jenkins security advisory lists this plugin among those with unresolved security issues [1]. Users are advised to restrict Overall/Read access to trusted users or consider disabling the plugin if not in use. No workaround is provided [2].