Information disclosure in Jenkins Configuration as Code plugin



Published: 2022-01-13
Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2022-23106
CWE-ID CWE-200
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Configuration as Code
Web applications / Modules and components for CMS

Vendor Jenkins

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Information disclosure

EUVDB-ID: #VU59592

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23106

CWE-ID: CWE-200 - Information Exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the affected plugin does not use a constant-time comparison when checking whether two authentication tokens are equal. A remote attacker can use statistical methods to obtain a valid authentication token.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Configuration as Code: 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 0.10, 0.11, 1.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12, 1.13, 1.14, 1.15, 1.16, 1.17, 1.18, 1.19, 1.20, 1.21, 1.22, 1.23, 1.23.1, 1.24, 1.25, 1.26, 1.27, 1.28, 1.29, 1.30, 1.31, 1.32, 1.33, 1.34, 1.35, 1.36, 1.36.1, 1.36.2, 1.37, 1.38, 1.39, 1.40, 1.41, 1.42, 1.43, 1.44, 1.45, 1.46, 1.47, 1.47.1, 1.48, 1.49, 1.50, 1.51, 1.52, 1.53, 1.53.1, 1.54, 1.54.1, 1.55

CPE2.3 External links

http://jenkins.io/security/advisory/2022-01-12/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###