[JENKINS:SECURITY-2283-1] Missing permission check in `tfs` allows enumerating credentials IDs

Severity Medium
Affected Packages 2
CVEs 1

tfs 5.157.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Those can be used as part of an attack to capture the credentials using another vulnerability.

As of publication of this advisory, there is no fix.

Package Affected Version
pkg:maven/org.jenkins-ci.plugins/tfs <= 5.157.1
pkg:github/jenkinsci/tfs-plugin <= 5.157.1
ID
JENKINS:SECURITY-2283-1
Severity
medium
Published
2021-03-30T00:00:00
(3 years ago)
Modified
2021-03-30T00:00:00
(3 years ago)
Rights
Jenkins Security Team
Other Advisories
Source # ID Name URL
Plugin repository tfs repository https://github.com/jenkinsci/tfs-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/tfs org.jenkins-ci.plugins tfs <= 5.157.1
Affected pkg:github/jenkinsci/tfs-plugin jenkinsci tfs-plugin <= 5.157.1
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date
Loading...