GHSA-2588-cx6w-6vm6

Source

https://github.com/advisories/GHSA-2588-cx6w-6vm6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-2588-cx6w-6vm6/GHSA-2588-cx6w-6vm6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2588-cx6w-6vm6

Aliases

CVE-2022-34781

Published

2022-07-01T00:01:07Z

Modified

2023-11-08T04:09:46.697595Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Missing permission checks in Jenkins XebiaLabs XL Release Plugin allow capturing credentials

Details

Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. XebiaLabs XL Release Plugin 22.0.1 requires Overall/Administer permission for the affected form validation methods.

Database specific

{
    "nvd_published_at": "2022-06-30T18:15:00Z",
    "github_reviewed_at": "2022-12-09T14:19:16Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-862"
    ]
}

References

Affected packages

Maven / com.xebialabs.ci:xlrelease-plugin

Package

Name: com.xebialabs.ci:xlrelease-plugin; View open source insights on deps.dev
Purl: pkg:maven/com.xebialabs.ci/xlrelease-plugin

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

22.0.1

Affected versions

2.*

2.2.1

4.*

4.0.9

4.0.11

4.5.0

4.5.1

4.8.0

5.*

5.0.0

6.*

6.0.0

6.1.0

6.1.1

6.1.2

7.*

7.5.0

7.5.1

7.5.2

7.5.3

7.5.4

7.5.5

7.5.6

7.5.7

10.*

10.0.0

22.*

22.0.0