CVE-2022-45383 Incorrect permission checks in Jenkins Support Core Plugin

What is CVE-2022-45383?

CVE-2022-45383 is a medium-severity missing authorization vulnerability in Jenkins Support Core Plugin, published on 15 Nov 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An incorrect permission check in Jenkins Support Core Plugin 1206.v14049fa_b_d860 and earlier allows attackers with Support/DownloadBundle permission to download a previously created support bundle containing information limited to users with Overall/Administer permission.

Weakness: CWE-863

Which versions are affected by CVE-2022-45383?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:support-core. It affects 1 product.

Products include Jenkins Support Core.

How do I fix CVE-2022-45383?

Upgrade org.jenkins-ci.plugins:support-core to 1206.1208.v9b_7a_1d48db_0f or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-45383 being exploited?

There is no known exploitation of CVE-2022-45383 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Support Core Plugin

• CVE-2022-25187 Jenkins Support Core Plugin stores sensitive data in plain text Medium 6.5
• CVE-2019-16539 Missing permission check in Jenkins Support Core Plugin Medium 6.5
• CVE-2019-16540 Jenkins Support Core Plugin allowed users with Overall/Read permission to delete arbitrary files Medium 6.5
• CVE-2021-21621 Support bundles can include user session IDs in Jenkins Support Core Plugin Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w2j3-pq63-339w.