CVE-2022-34785

Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them.
Configurations

Configuration 1 (hide)

cpe:2.3:a:jenkins:build-metrics:*:*:*:*:*:jenkins:*:*

History

03 Nov 2023, 19:06

Type Values Removed Values Added
CWE CWE-863

25 Oct 2023, 18:17

Type Values Removed Values Added
CWE CWE-862

08 Jul 2022, 17:12

Type Values Removed Values Added
CPE cpe:2.3:a:jenkins:build-metrics:*:*:*:*:*:jenkins:*:*
CVSS v2 : unknown
v3 : unknown
v2 : 4.0
v3 : 4.3
First Time Jenkins build-metrics
Jenkins
References (CONFIRM) https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2643 - (CONFIRM) https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2643 - Vendor Advisory

30 Jun 2022, 18:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-06-30 18:15

Updated : 2023-12-10 14:22


NVD link : CVE-2022-34785

Mitre link : CVE-2022-34785

CVE.ORG link : CVE-2022-34785


JSON object : View

Products Affected

jenkins

  • build-metrics
CWE
CWE-863

Incorrect Authorization