Permission Check Bypass in Jenkins HCL AppScan Plugin

Executive Summary

This vulnerability is a missing permission check in the Jenkins HCL AppScan Plugin version 1.8.3 and earlier. It allows users with Overall/Read permission to view and enumerate credentials IDs stored in Jenkins.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 or earlier. To detect it, inspect Jenkins logs for unauthorized credential ID enumeration attempts or review plugin configurations for Overall/Read permission misuse. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

Attackers with Overall/Read permission could identify stored credentials, potentially leading to unauthorized access to sensitive systems or data if those credentials are used elsewhere.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements such as GDPR or HIPAA by exposing protected information.

Useful 0 Not Useful 0

Mitigation Strategies

Update Jenkins HCL AppScan Plugin to a version later than 1.8.3 where permission checks are properly enforced. If updating is not possible, restrict Overall/Read permission to trusted users only.

Useful 0 Not Useful 0