Skip to content
Sign in
Not rated

CVE-2022-34781 Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read…

Description

Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected products and versions

Product Affected versions Fixed in
Jenkins XebiaLabs XL Release Plugin 22.0 earliest → 22.0.0 No fix stated

Other CVEs of Jenkins XebiaLabs XL Release Plugin

The 3 CVEs of Jenkins XebiaLabs XL Release Plugin →
CVE-2022-34780 A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows… Not rated CVE-2022-34779 A missing permission check in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers with… Not rated
Track this CVE