Improper Authorization Affecting org.jenkins-ci.plugins:repository-connector package, versions [0,]


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.05% (23rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Authorization vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JAVA-ORGJENKINSCIPLUGINS-2964184
  • published31 Jul 2022
  • disclosed31 Jul 2022
  • creditUnknown

Introduced: 31 Jul 2022

CVE-2022-36903  (opens in a new tab)
CWE-285  (opens in a new tab)

How to fix?

There is no fixed version for org.jenkins-ci.plugins:repository-connector.

Overview

org.jenkins-ci.plugins:repository-connector is a repository Connector Jenkins plugin that adds a build step which allows to resolve artifacts from a maven repository like nexus.

Affected versions of this package are vulnerable to Improper Authorization due to a missing permission check that allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CVSS Base Scores

version 3.1