CVE-2022-45383

Description

Support Core Plugin defines the permission Support/DownloadBundle that allows users without Overall/Administer permission to create and download support bundles containing a limited set of diagnostic information. Support Core Plugin 1206.v14049fa_b_d860 and earlier does not correctly perform permission checks in several HTTP endpoints. This allows attackers with Support/DownloadBundle permission to download a previously created support bundle containing information limited to users with Overall/Administer permission. Support Core Plugin 1206.1208.v9b_7a_1d48db_0f deprecates the Support/DownloadBundle permission. The Overall/Administer permission is now required to download support bundles.

How to fix CVE-2022-45383

To remediate CVE-2022-45383, upgrade the affected package to a fixed version below.

• —upgrade to 1206.1208.v9b_7a_1d48db_0f or later

Is CVE-2022-45383 being exploited?

Low — EPSS is 0.6%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 1206.1208.v9b_7a_1d48db_0f

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-45383
• PATCHgithub.com/jenkinsci/support-core-plugin
• WEBwww.openwall.com/lists/oss-security/2022/11/15/4
• WEBgithub.com/jenkinsci/support-core-plugin/commit/9b7a1d48db0fdfb840ca3393e9462e687e69385b