GitHub Advisoryadvisory · Maven

GHSA-w2j3-pq63-339w Incorrect permission checks in Jenkins Support Core Plugin

MEDIUM Published 2022-11-16 Modified 2022-12-15 Official page ↗
Aliases
CVE-2022-45383
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:support-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-276, CWE-863
Reviewed
2022-11-21

Affected packages

• Maven org.jenkins-ci.plugins:support-core: < 1206.1208.v9b_7a_1d48db_0f → fixed in 1206.1208.v9b_7a_1d48db_0f

Description

Support Core Plugin defines the permission Support/DownloadBundle that allows users without Overall/Administer permission to create and download support bundles containing a limited set of diagnostic information. Support Core Plugin 1206.v14049fa_b_d860 and earlier does not correctly perform permission checks in several HTTP endpoints. This allows attackers with Support/DownloadBundle permission to download a previously created support bundle containing information limited to users with Overall/Administer permission. Support Core Plugin 1206.1208.v9b_7a_1d48db_0f deprecates the Support/DownloadBundle permission. The Overall/Administer permission is now required to download support bundles.

Related

Alias · CVE (1)

  • CVE-2022-45383 An incorrect permission check in Jenkins Support Core Plugin 1206.v14049fa_b_d860 and earlier allows attackers with Support/DownloadBundle… vulnerability

Weakness · CWE (2)

  • CWE-276 Incorrect Default Permissions weakness
  • CWE-863 Incorrect Authorization weakness

References