CVE-2022-36892

Name of the Vulnerable Software and Affected Versions Jenkins rhnpush-plugin Plugin versions 0.5.1 and earlier

Description The issue is related to insufficient authorization procedures in the Jenkins rhnpush-plugin. This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A sequence of requests can be used to effectively list workspace contents.

Recommendations For Jenkins rhnpush-plugin Plugin versions 0.5.1 and earlier, update to version 0.5.2 or later, which requires Item/Workspace permission to validate patterns with workspace contents. As a temporary workaround, consider restricting access to the form validation method to minimize the risk of exploitation.