Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/54737?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/54737?format=api", "vulnerability_id": "VCID-rs56-6qvx-vucg", "summary": "Insufficiently Protected Credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin\nWhen pipelines are created using the pipeline creation wizard in Blue Ocean, the credentials used are stored in the per-user credentials store of the user creating the pipeline. To allow pipelines to use this credential to scan repositories and checkout from SCM, the Blue Ocean Credentials Provider allows pipelines to access a specific credential from the per-user credentials store in Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier.\n\nAs a result, attackers with Job/Configure permission can rewrite job configurations in a way that lets them access and capture any attacker-specified credential from any user’s private credentials store.\n\nPipeline SCM API for Blue Ocean Plugin 1.25.4 deprecates the Blue Ocean Credentials Provider and disables it by default. As a result, all jobs initially set up using the Blue Ocean pipeline creation wizard and configured to use the credential specified at that time will no longer be able to access the credential, resulting in failures to scan repositories, checkout from SCM, etc. unless the repository is public and can be accessed without credentials.\n\nThis also applies to newly created pipelines after Pipeline SCM API for Blue Ocean Plugin has been updated to 1.25.4.\n\nAdministrators should reconfigure affected pipelines to use a credential from the Jenkins credential store or a folder credential store. See [this help page on cloudbees.com](https://cloudbees.com/r/blue-ocean-credentials-removal) to learn more.\n\nTo re-enable the Blue Ocean Credentials Provider, set the Java system property `io.jenkins.blueocean.rest.impl.pipeline.credential.BlueOceanCredentialsProvider.enabled` to `true`. Doing so is discouraged, as that will restore the unsafe behavior.\n\nWhile Credentials Plugin provides the _Configure Credential Providers_ UI to enable or disable certain credentials providers, enabling the Blue Ocean Credentials Provider there is not enough in Pipeline SCM API for Blue Ocean Plugin 1.25.4. Both the UI and system property need to enable the Blue Ocean Credentials Provider.\n\nAdministrators not immediately able to update Blue Ocean are advised to disable the Blue Ocean Credentials Provider through the UI at _Manage Jenkins_ » _Configure Credential Providers_ and to reconfigure affected pipelines to use a credential from the Jenkins credential store or a folder credential store.", "aliases": [ { "alias": "CVE-2022-30952" }, { "alias": "GHSA-g74w-93cp-5p3p" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/82004?format=api", "purl": "pkg:maven/io.jenkins.blueocean/blueocean-pipeline-scm-api@1.25.4", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/io.jenkins.blueocean/blueocean-pipeline-scm-api@1.25.4" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/55268?format=api", "purl": "pkg:maven/io.jenkins.blueocean/blueocean@1.25.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4qvq-xv22-xbed" }, { "vulnerability": "VCID-rs56-6qvx-vucg" }, { "vulnerability": "VCID-xq5k-dyk9-u3ct" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/io.jenkins.blueocean/blueocean@1.25.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/98056?format=api", "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.8.1672842762-1?arch=el8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4qvq-xv22-xbed" }, { "vulnerability": "VCID-7ez2-n617-u3dq" }, { "vulnerability": "VCID-9h4k-xjx5-afc8" }, { "vulnerability": "VCID-c2jh-gx5w-mqcd" }, { "vulnerability": "VCID-ca7m-fb38-kfe2" }, { "vulnerability": "VCID-fzvq-dpvh-v7eu" }, { "vulnerability": "VCID-gxu6-51zm-sfh7" }, { "vulnerability": "VCID-hg91-mnh3-g3a4" }, { "vulnerability": "VCID-k6wy-rwhv-ckd2" }, { "vulnerability": "VCID-qsut-4d83-97h1" }, { "vulnerability": "VCID-rs56-6qvx-vucg" }, { "vulnerability": "VCID-tt48-pfzv-mkgt" }, { "vulnerability": "VCID-ubq1-gzr6-x3fu" }, { "vulnerability": "VCID-xq5k-dyk9-u3ct" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/jenkins-2-plugins@4.8.1672842762-1%3Farch=el8" }, { "url": "http://public2.vulnerablecode.io/api/packages/97536?format=api", "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.9.1675668922-1?arch=el8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-13zs-2sn8-3yey" }, { "vulnerability": "VCID-1tha-u7dt-tfc9" }, { "vulnerability": "VCID-2zhb-qfhq-xkdp" }, { "vulnerability": "VCID-4qvq-xv22-xbed" }, { "vulnerability": "VCID-5jjh-qcnz-mye7" }, { "vulnerability": "VCID-73th-g3mx-dqf1" }, { "vulnerability": "VCID-892e-957y-4yc8" }, { "vulnerability": "VCID-9h4k-xjx5-afc8" }, { "vulnerability": "VCID-atqg-nfz6-zyfs" }, { "vulnerability": "VCID-ca7m-fb38-kfe2" }, { "vulnerability": "VCID-dmkc-42vj-gbhc" }, { "vulnerability": "VCID-fzvq-dpvh-v7eu" }, { "vulnerability": "VCID-gxu6-51zm-sfh7" }, { "vulnerability": "VCID-mm3e-4pej-byed" }, { "vulnerability": "VCID-n5vc-ggjg-kfc1" }, { "vulnerability": "VCID-netd-rr9e-wbg5" }, { "vulnerability": "VCID-pnge-tumu-v7e2" }, { "vulnerability": "VCID-pwtj-az3g-zka3" }, { "vulnerability": "VCID-rs56-6qvx-vucg" }, { "vulnerability": "VCID-rxtr-936k-h3cc" }, { "vulnerability": "VCID-s839-rpta-6bej" }, { "vulnerability": "VCID-tx8n-nmhx-gqg1" }, { "vulnerability": "VCID-ubq1-gzr6-x3fu" }, { "vulnerability": "VCID-xq5k-dyk9-u3ct" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/jenkins-2-plugins@4.9.1675668922-1%3Farch=el8" }, { "url": "http://public2.vulnerablecode.io/api/packages/97535?format=api", "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.10.1675144701-1?arch=el8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-13zs-2sn8-3yey" }, { "vulnerability": "VCID-1tha-u7dt-tfc9" }, { "vulnerability": "VCID-2zhb-qfhq-xkdp" }, { "vulnerability": "VCID-4qvq-xv22-xbed" }, { "vulnerability": "VCID-5jjh-qcnz-mye7" }, { "vulnerability": "VCID-73th-g3mx-dqf1" }, { "vulnerability": "VCID-892e-957y-4yc8" }, { "vulnerability": "VCID-9h4k-xjx5-afc8" }, { "vulnerability": "VCID-atqg-nfz6-zyfs" }, { "vulnerability": "VCID-ca7m-fb38-kfe2" }, { "vulnerability": "VCID-fzvq-dpvh-v7eu" }, { "vulnerability": "VCID-gxu6-51zm-sfh7" }, { "vulnerability": "VCID-mm3e-4pej-byed" }, { "vulnerability": "VCID-n5vc-ggjg-kfc1" }, { "vulnerability": "VCID-netd-rr9e-wbg5" }, { "vulnerability": "VCID-pnge-tumu-v7e2" }, { "vulnerability": "VCID-pwtj-az3g-zka3" }, { "vulnerability": "VCID-rs56-6qvx-vucg" }, { "vulnerability": "VCID-rxtr-936k-h3cc" }, { "vulnerability": "VCID-s839-rpta-6bej" }, { "vulnerability": "VCID-tx8n-nmhx-gqg1" }, { "vulnerability": "VCID-ubq1-gzr6-x3fu" }, { "vulnerability": "VCID-xq5k-dyk9-u3ct" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/jenkins-2-plugins@4.10.1675144701-1%3Farch=el8" }, { "url": "http://public2.vulnerablecode.io/api/packages/97533?format=api", "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.12.1675702407-1?arch=el8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1pzb-gkrf-m3hq" }, { "vulnerability": "VCID-1tha-u7dt-tfc9" }, { "vulnerability": "VCID-2zhb-qfhq-xkdp" }, { "vulnerability": "VCID-73th-g3mx-dqf1" }, { "vulnerability": "VCID-9h46-72hw-bkcr" }, { "vulnerability": "VCID-atqg-nfz6-zyfs" }, { "vulnerability": "VCID-k6wy-rwhv-ckd2" }, { "vulnerability": "VCID-n5vc-ggjg-kfc1" }, { "vulnerability": "VCID-netd-rr9e-wbg5" }, { "vulnerability": "VCID-pnge-tumu-v7e2" }, { "vulnerability": "VCID-rs56-6qvx-vucg" }, { "vulnerability": "VCID-rxtr-936k-h3cc" }, { "vulnerability": "VCID-s839-rpta-6bej" }, { "vulnerability": "VCID-tx8n-nmhx-gqg1" }, { "vulnerability": "VCID-v2pq-1qhm-4qb9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/jenkins-2-plugins@4.12.1675702407-1%3Farch=el8" } ], "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30952.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30952.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30952", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00289", "scoring_system": "epss", "scoring_elements": "0.52338", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00289", "scoring_system": "epss", "scoring_elements": "0.5231", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59383", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59296", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59347", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59359", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59379", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59362", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59344", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59377", "published_at": "2026-04-16T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30952" }, { "reference_url": "https://github.com/jenkinsci/blueocean-plugin/commit/c4beeda0b574c297ac664511029feed0a15abaf1", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/blueocean-plugin/commit/c4beeda0b574c297ac664511029feed0a15abaf1" }, { "reference_url": "https://github.com/jenkinsci/blueocean-plugin/tree/master/blueocean-pipeline-scm-api", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/blueocean-plugin/tree/master/blueocean-pipeline-scm-api" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952" }, { "reference_url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/05/17/8", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119645", "reference_id": "2119645", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119645" }, { "reference_url": "https://github.com/advisories/GHSA-g74w-93cp-5p3p", "reference_id": "GHSA-g74w-93cp-5p3p", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-g74w-93cp-5p3p" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0017", "reference_id": "RHSA-2023:0017", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0017" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0560", "reference_id": "RHSA-2023:0560", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0560" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0777", "reference_id": "RHSA-2023:0777", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0777" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:1064", "reference_id": "RHSA-2023:1064", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "weaknesses": [ { "cwe_id": 522, "name": "Insufficiently Protected Credentials", "description": "The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval." }, { "cwe_id": 1220, "name": "Insufficient Granularity of Access Control", "description": "The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." } ], "exploits": [], "severity_range_score": "4.0 - 6.9", "exploitability": "0.5", "weighted_severity": "6.2", "risk_score": 3.1, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-rs56-6qvx-vucg" }