Vulnerabilities > CVE-2022-36896 - Missing Authorization vulnerability in Jenkins Compuware Source Code Download for Endevor, Pds, and Ispw 2.0.12

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
jenkins
CWE-862

Summary

A missing permission check in Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins.

Common Weakness Enumeration (CWE)