AVID-2026-R1002

Description

Vulnerability CVE-2022-25201

Details

Missing permission checks in Jenkins Checkmarx Plugin 2022.1.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Reason for inclusion in AVID: CVE-2022-25201 describes a credential leakage vulnerability in the Jenkins Checkmarx Plugin (older versions) where an attacker with basic Jenkins permissions can exfiltrate credentials by connecting to an attacker-controlled server. Jenkins and its plugins are widely used in CI/CD pipelines that build, test, and deploy AI software, models, and data pipelines. Therefore, this is a software supply chain vulnerability that can impact general-purpose AI systems when such CI/CD components are part of their build/deploy workflow. It is an actionable security flaw (credential theft) with clear impact in software supply chains, not hardware-only.

References

• NVD entry
• https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1017

Affected or Relevant Artifacts

• Developer: Jenkins project
• Deployer: Jenkins project
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2022-02-15
• Version: 0.3.3
• AVID Entry