CVE-2022-34180 Improper authorization in Jenkins Embeddable Build Status Plugin bypasses ViewStatus permission requirement

What is CVE-2022-34180?

CVE-2022-34180 is a high-severity missing authorization vulnerability in Jenkins Embeddable Build Status Plugin, published on 22 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotected" status badge access, allowing attackers without any permissions to obtain the build status badge icon for any attacker-specified job and/or build.

Weakness: CWE-863

Which versions are affected by CVE-2022-34180?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:embeddable-build-status. It affects 1 product.

Products include Jenkins Embeddable Build Status.

How do I fix CVE-2022-34180?

Upgrade org.jenkins-ci.plugins:embeddable-build-status to 2.0.4 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-34180 being exploited?

There is no known exploitation of CVE-2022-34180 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Embeddable Build Status Plugin

• CVE-2022-34179 Path Traversal vulnerability in Jenkins Embeddable Build Status Plugin High 7.5
• CVE-2022-34178 Reflected Cross site scripting in Jenkins Embeddable Build Status Plugin Medium 6.1
• CVE-2019-10346 Jenkins Embeddable Build Status Plugin contains Cross-site Scripting Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xxhf-xq6v-c8mj.