Skip to content
Sign in
6.5 Medium

CVE-2022-41250 A missing permission check in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers with Overall/Read…

Description

A missing permission check in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected products and versions

Product Affected versions Fixed in
Jenkins SCM HttpClient Plugin 1.5 earliest → 1.5 No fix stated

Other CVEs of Jenkins SCM HttpClient Plugin

The 2 CVEs of Jenkins SCM HttpClient Plugin →
CVE-2022-41249 A cross-site request forgery (CSRF) vulnerability in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers to… 8.8 High
Track this CVE