CVE-2022-20616: vulnerability in Jenkins Credentials Binding Plugin
Published · Updated
Follow this CVE+ Monitor Jenkins Credentials Binding Plugin+ Monitor org.jenkins-ci.plugins:credentials-binding
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.9%
Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file.
Affected products
Jenkins project · Jenkins Credentials Binding PluginRelated CVEs — Jenkins Credentials Binding Plugin
In the same product, most dangerous first.