medium4.3
CVE-2022-27199
Missing permission checks in AWS Credentials Plugin
Impact
A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:aws-credentials | <= 189.v3551d5642995 | 191.vcb_f183ce58b_9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Cloudbees Aws Credentials | before 191.vcb_f183ce58b_9 |