CVE-2022-41246 - A missing permission check in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins

Back Back to CVE browser

MEDIUM

A missing permission check in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins

Published Sep 21, 2022

6.5

MEDIUM

CVSS 3.1

EPSS 0.77%

Description

A missing permission check in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected products

Vendor Jenkins project Product Jenkins Worksoft Execution Manager Plugin Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=10.0.3.503

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins Worksoft Execution Manager Plugin

n/a

Version	Status	Constraints
unspecified	affected	<=10.0.3.503

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (3)

https://github.com/advisories/GHSA-p5hr-rf6w-3vvh
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41246
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2237
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-p5hr-rf6w-3vvh		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41246
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2237		x_refsource_CONFIRMVendor Advisory