SB2022062420 - Multiple vulnerabilities in Jenkins EasyQA plugin

Description

This security bulletin contains information about 3 vulnerabilities.

1) Unprotected storage of credentials (CVE-ID: CVE-2022-34202)

CWE-ID: CWE-256 - Unprotected Storage of Credentials

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to gain access to other users' credentials.

The vulnerability exists due to the affected plugin stores user passwords unencrypted in its global configuration file EasyQAPluginProperties.xml on the Jenkins controller as part of its configuration. A local user can view contents of the configuration file and gain access to passwords for 3rd party integration.

2) Cross-site request forgery (CVE-ID: CVE-2022-34203)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

3) Improper access control (CVE-ID: CVE-2022-34204)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in a method implementing form validation. A remote user can connect to an attacker-specified HTTP server.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2066
• https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2281