CVE-2022-34813 - A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to create and delete XPath expressions

Back Back to CVE browser

MEDIUM

A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to create and delete XPath expressions

Published Jun 30, 2022

4.3

MEDIUM

CVSS 3.1

EPSS 0.59%

Description

A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to create and delete XPath expressions.

Affected products

Vendor Jenkins project Product Jenkins XPath Configuration Viewer Plugin Default
unknown
Affected
- ≥ unspecified, ≤ 1.1.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jenkins project	Jenkins XPath Configuration Viewer Plugin	unknown	Affected ≥ unspecified, ≤ 1.1.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6217
Advisory
https://github.com/advisories/GHSA-3fj7-78h2-w98x
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-34813
https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2658
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6217		Advisory
https://github.com/advisories/GHSA-3fj7-78h2-w98x		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-34813
https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2658		x_refsource_CONFIRMVendor Advisory