CVE-2022-45385 - A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository

Back Back to CVE browser

HIGH

A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository

Published Nov 15, 2022

7.5

HIGH

CVSS 3.1

EPSS 0.60%

Description

A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.

Affected products

Vendor Jenkins project Product Jenkins CloudBees Docker Hub/Registry Notification Plugin Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=2.6.2
- Version
  2.6.0.1
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins CloudBees Docker Hub/Registry Notification Plugin

n/a

Version	Status	Constraints
unspecified	affected	<=2.6.2
2.6.0.1	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (6)

http://www.openwall.com/lists/oss-security/2022/11/15/4
mailing-listMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-7433
Advisory
https://github.com/advisories/GHSA-v535-pc6r-77qh
Advisory
https://github.com/jenkinsci/dockerhub-notification-plugin/commit/1163d4f297af23266c032fc66bd603b97f9ecd4b
https://nvd.nist.gov/vuln/detail/CVE-2022-45385
https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2843
Vendor Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2022/11/15/4		mailing-listMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-7433		Advisory
https://github.com/advisories/GHSA-v535-pc6r-77qh		Advisory
https://github.com/jenkinsci/dockerhub-notification-plugin/commit/1163d4f297af23266c032fc66bd603b97f9ecd4b
https://nvd.nist.gov/vuln/detail/CVE-2022-45385
https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2843		Vendor Advisory