CVE-2022-34174

Description

In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.55%• Percentile: 68%

Techniques & Countermeasures

• CWE-203•Observable Discrepancy

  The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

Affected Systems

• jenkins project•jenkins

  ≥ unspecified, ≤ 2.355 | ≥ unspecified, ≤ LTS 2.332.3

• Unknown•Jenkins

  ≤ 2.332.3 | ≤ 2.355

• org.jenkins-ci.main•jenkins-core

  ≥ 2.334, < 2.356 | < 2.332.4

References (4)

• https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2566
• https://nvd.nist.gov/vuln/detail/CVE-2022-34174
• https://github.com/jenkinsci/jenkins/commit/957ef5902f2e40b6358e6d10f12b26f9dbd2f75a
• https://github.com/jenkinsci/jenkins