Jenkins Build-Publisher Plugin Insecure HTTP Endpoint Vulnerability

CVE-2022-41230

What is CVE-2022-41230?

The Jenkins Build-Publisher Plugin prior to version 1.23 lacks adequate permission checks in its HTTP endpoint. This oversight permits users with Overall/Read permissions to access sensitive information, including the names and URLs of Jenkins servers where builds are configured for publication, along with details of builds awaiting publication to these servers. Such vulnerabilities can be exploited to compromise the integrity of the build process and expose critical server configurations.

References