CVE-2022-30952 Insufficiently Protected Credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin

What is CVE-2022-30952?

CVE-2022-30952 is a medium-severity missing authorization vulnerability in Jenkins Pipeline SCM API for Blue Ocean Plugin, published on 17 May 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.

Weakness: CWE-522

Which versions are affected by CVE-2022-30952?

2 open source packages ship an affected version, including io.jenkins.blueocean:blueocean-pipeline-scm-api. It affects 1 product.

Products include Jenkins Blue Ocean.

How do I fix CVE-2022-30952?

Upgrade io.jenkins.blueocean:blueocean-pipeline-scm-api to 1.25.4 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-30952 being exploited?

There is no known exploitation of CVE-2022-30952 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Pipeline SCM API for Blue Ocean Plugin

• CVE-2023-40341 Jenkins Blue Ocean Plugin cross-site request forgery vulnerability High 8.8
• CVE-2017-1000106 Improper Authentication in Jenkins Blue Ocean Plugin High 8.5
• CVE-2022-30953 Cross Site Request Forgery in Jenkins Blue Ocean Plugin Medium 6.5
• CVE-2022-30954 Missing permission check in Jenkins Blue Ocean Plugin Medium 6.5
• CVE-2020-2254 Path traversal vulnerability in Blue Ocean Plugin Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g74w-93cp-5p3p.