CVE-2022-36896

Published: Jul 27, 2022Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

A missing permission check in Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins.

Affected (1)

Products: Jenkins: Compuware Source Code Download For Endevor, Pds, And Ispw

1 product

Compuware Source Code Download For Endevor, Pds, And Ispw

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jenkins Compuware Source Code Download For Endevor, Pds, And Ispw	Up to 2.0.12

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (4)

http://www.openwall.com/lists/oss-security/2022/07/27/1

Source: jenkinsci-cert@googlegroups.com

Mailing ListThird Party Advisory

https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2621

Source: jenkinsci-cert@googlegroups.com

Vendor Advisory

http://www.openwall.com/lists/oss-security/2022/07/27/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2621

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.