A missing/An incorrect permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2022/03/15/2 | Mailing List Third Party Advisory |
| https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2681 | Vendor Advisory |
Configurations
History
16 Feb 2024, 18:46
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
28 Jun 2023, 13:44
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-863 |
24 Mar 2022, 20:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MLIST) http://www.openwall.com/lists/oss-security/2022/03/15/2 - Mailing List, Third Party Advisory | |
| References | (CONFIRM) https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2681 - Vendor Advisory | |
| CPE | cpe:2.3:a:jenkins:kubernetes_continuous_deploy:*:*:*:*:*:jenkins:*:* | |
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 6.5 |
| CWE | CWE-862 |
15 Mar 2022, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Mar 2022, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-03-15 17:15
Updated : 2024-02-16 18:46
NVD link : CVE-2022-27211
Mitre link : CVE-2022-27211
CVE.ORG link : CVE-2022-27211
JSON object : View
Products Affected
jenkins
- kubernetes_continuous_deploy
CWE
CWE-862
Missing Authorization