Missing Permission Check in Jenkins vRealize Orchestrator Plugin by Jenkins

CVE-2022-34212

What is CVE-2022-34212?

The vRealize Orchestrator Plugin for Jenkins has a security issue that arises from a missing permission check. This vulnerability could allow an attacker with Overall/Read permission to exploit the system by sending an unauthorized HTTP POST request to a specified URL. Such an attack compromises the intended access controls, potentially leading to exposure of sensitive data or manipulation of Jenkins operations. Users are advised to update to the latest version to mitigate risks associated with this vulnerability.

References