Missing Permission Check in Jenkins Kubernetes Continuous Deploy Plugin Exposes Sensitive Data

CVE-2022-27209

What is CVE-2022-27209?

A vulnerability exists in the Kubernetes Continuous Deploy Plugin for Jenkins whereby a missing permission check allows users with Overall/Read permissions to enumerate sensitive credential IDs stored in Jenkins. This poses a significant risk as attackers may exploit this weakness to gain insights into user credentials, potentially leading to unauthorized access and further exploitation. It is crucial for Jenkins administrators to update to the latest version of the plugin to mitigate this risk and bolster the security of their CI/CD pipeline.

References