VDB

CISA-2022-43417

CISA-2022-43417 PUBLISHED CVSS 4.3 MEDIUM

Reported by jenkins · Published October 19, 2022

Jenkins Katalon Plugin 1.0.32 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Risk Scores

CVSS 3.1
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected Products

VendorProductVersions
Jenkins projectJenkins Katalon Pluginunspecified
Jenkins projectJenkins Katalon Pluginunspecified, unspecified

Timeline

  • Oct 19, 2022 CVE Published
  • May 8, 2025 CVE Updated

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›