Unauthorized Access Risk in Jenkins Snow Commander Plugin by Jenkins
CVE-2022-25193

6.5MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Snow Commander Plugin
Vendor
CVE Published:
15 February 2022

Summary

The Jenkins Snow Commander Plugin, in versions 1.10 and earlier, contains a security flaw due to inadequate permission validation. This vulnerability permits users with Overall/Read permissions to connect to arbitrary webservers using attacker-defined credential IDs. As a consequence, this can lead to unauthorized access to sensitive credentials stored within Jenkins, heightening risks of credential exposure and potential system compromise.

Affected Version(s)

Jenkins Snow Commander Plugin <= 1.10

References

https://www.jenkins.io/security/advisory/2022-02-15/#SECU...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.