Executive brief
Jenkins Repository Connector Plugin allows attackers with Overall/Read permission to enumerate credentials IDs
Affected products
- Maven org.jenkins-ci.plugins:repository-connector
Junglewise Threat Intelligence
CVE-2022-36903: Jenkins Repository Connector Plugin allows attackers with Overall/Read permission to enumerate credentials IDs
CVE-2022-36903 · Severity: low · CVSS 3.1 · Published 2022-07-28
Technologies: org.jenkins-ci.plugins:repository-connector (Maven). Vendors: Maven.
Related threats
- Jenkins Repository Connector Plugin does not perform a permission check in a method implementing form validation
- Cross-site Scripting in Jenkins Repository Connector Plugin
- Stored XSS vulnerability in Jenkins Repository Connector Plugin
- Credentials transmitted in plain text by Repository Connector Plugin
- Jenkins Repository Connector Plugin has insufficiently protected credentials