Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-rs56-6qvx-vucg
Vulnerability ID VCID-rs56-6qvx-vucg
Aliases CVE-2022-30952
GHSA-g74w-93cp-5p3p
Summary Insufficiently Protected Credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin When pipelines are created using the pipeline creation wizard in Blue Ocean, the credentials used are stored in the per-user credentials store of the user creating the pipeline. To allow pipelines to use this credential to scan repositories and checkout from SCM, the Blue Ocean Credentials Provider allows pipelines to access a specific credential from the per-user credentials store in Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier. As a result, attackers with Job/Configure permission can rewrite job configurations in a way that lets them access and capture any attacker-specified credential from any user’s private credentials store. Pipeline SCM API for Blue Ocean Plugin 1.25.4 deprecates the Blue Ocean Credentials Provider and disables it by default. As a result, all jobs initially set up using the Blue Ocean pipeline creation wizard and configured to use the credential specified at that time will no longer be able to access the credential, resulting in failures to scan repositories, checkout from SCM, etc. unless the repository is public and can be accessed without credentials. This also applies to newly created pipelines after Pipeline SCM API for Blue Ocean Plugin has been updated to 1.25.4. Administrators should reconfigure affected pipelines to use a credential from the Jenkins credential store or a folder credential store. See [this help page on cloudbees.com](https://cloudbees.com/r/blue-ocean-credentials-removal) to learn more. To re-enable the Blue Ocean Credentials Provider, set the Java system property `io.jenkins.blueocean.rest.impl.pipeline.credential.BlueOceanCredentialsProvider.enabled` to `true`. Doing so is discouraged, as that will restore the unsafe behavior. While Credentials Plugin provides the _Configure Credential Providers_ UI to enable or disable certain credentials providers, enabling the Blue Ocean Credentials Provider there is not enough in Pipeline SCM API for Blue Ocean Plugin 1.25.4. Both the UI and system property need to enable the Blue Ocean Credentials Provider. Administrators not immediately able to update Blue Ocean are advised to disable the Blue Ocean Credentials Provider through the UI at _Manage Jenkins_ » _Configure Credential Providers_ and to reconfigure affected pipelines to use a credential from the Jenkins credential store or a folder credential store.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-522 Insufficiently Protected Credentials
CWE-1220 Insufficient Granularity of Access Control
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30952.json
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2022-30952
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2022-30952
epss 0.00378 https://api.first.org/data/v1/epss?cve=CVE-2022-30952
epss 0.00378 https://api.first.org/data/v1/epss?cve=CVE-2022-30952
epss 0.00378 https://api.first.org/data/v1/epss?cve=CVE-2022-30952
epss 0.00378 https://api.first.org/data/v1/epss?cve=CVE-2022-30952
epss 0.00378 https://api.first.org/data/v1/epss?cve=CVE-2022-30952
epss 0.00378 https://api.first.org/data/v1/epss?cve=CVE-2022-30952
epss 0.00378 https://api.first.org/data/v1/epss?cve=CVE-2022-30952
epss 0.00378 https://api.first.org/data/v1/epss?cve=CVE-2022-30952
epss 0.00378 https://api.first.org/data/v1/epss?cve=CVE-2022-30952
epss 0.00378 https://api.first.org/data/v1/epss?cve=CVE-2022-30952
epss 0.00378 https://api.first.org/data/v1/epss?cve=CVE-2022-30952
epss 0.00378 https://api.first.org/data/v1/epss?cve=CVE-2022-30952
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-g74w-93cp-5p3p
cvssv3.1 5.3 https://github.com/jenkinsci/blueocean-plugin/commit/c4beeda0b574c297ac664511029feed0a15abaf1
generic_textual MODERATE https://github.com/jenkinsci/blueocean-plugin/commit/c4beeda0b574c297ac664511029feed0a15abaf1
cvssv3.1 5.3 https://github.com/jenkinsci/blueocean-plugin/tree/master/blueocean-pipeline-scm-api
generic_textual MODERATE https://github.com/jenkinsci/blueocean-plugin/tree/master/blueocean-pipeline-scm-api
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2022-30952
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-30952
cvssv3.1 5.3 https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714
generic_textual MODERATE https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714
cvssv3.1 5.3 http://www.openwall.com/lists/oss-security/2022/05/17/8
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2022/05/17/8
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30952.json
https://api.first.org/data/v1/epss?cve=CVE-2022-30952
https://github.com/jenkinsci/blueocean-plugin/commit/c4beeda0b574c297ac664511029feed0a15abaf1
https://github.com/jenkinsci/blueocean-plugin/tree/master/blueocean-pipeline-scm-api
https://nvd.nist.gov/vuln/detail/CVE-2022-30952
https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714
http://www.openwall.com/lists/oss-security/2022/05/17/8
2119645 https://bugzilla.redhat.com/show_bug.cgi?id=2119645
GHSA-g74w-93cp-5p3p https://github.com/advisories/GHSA-g74w-93cp-5p3p
RHSA-2023:0017 https://access.redhat.com/errata/RHSA-2023:0017
RHSA-2023:0560 https://access.redhat.com/errata/RHSA-2023:0560
RHSA-2023:0777 https://access.redhat.com/errata/RHSA-2023:0777
RHSA-2023:1064 https://access.redhat.com/errata/RHSA-2023:1064
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30952.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/jenkinsci/blueocean-plugin/commit/c4beeda0b574c297ac664511029feed0a15abaf1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/jenkinsci/blueocean-plugin/tree/master/blueocean-pipeline-scm-api
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-30952
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Found at http://www.openwall.com/lists/oss-security/2022/05/17/8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.5231
EPSS Score 0.00289
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:08:09.155272+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-g74w-93cp-5p3p/GHSA-g74w-93cp-5p3p.json 38.0.0