CVE-2022-30951

Опубликовано: 17 мая 2022

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access control, potentially allowing users to start processes even if they're not allowed to log in.

Ссылки

http://www.openwall.com/lists/oss-security/2022/05/17/8
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2604
Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/05/17/8
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2604
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:wmi_windows_agents:*:*:*:*:*:jenkins:*:*

Версия до 1.8.1 (исключая)

EPSS

Процентиль: 75%

0.0091

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-862

Связанные уязвимости

GHSA-p566-wpxx-574m

CVSS3: 4.2

github

больше 3 лет назад

Missing Authorization in Jenkins WMI Windows Agents plugin