CVE-2022-36896

A missing permission check in Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins.

• CWE-862

• http://www.openwall.com/lists/oss-security/2022/07/27/1Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2621Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/07/27/1Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2621Vendor Advisory

Published

Jul 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36890Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earli…4.3
• CVE-2022-36891A missing permission check in Jenkins Deployer Framework Plu…4.3
• CVE-2022-36892Jenkins rhnpush-plugin Plugin 0.5.1 and earlier does not per…4.3
• CVE-2022-36893Jenkins rpmsign-plugin Plugin 0.5.0 and earlier does not per…4.3
• CVE-2022-36894An arbitrary file write vulnerability in Jenkins CLIF Perfor…6.5
• CVE-2022-36895A missing permission check in Jenkins Compuware Topaz Utilit…4.3
• CVE-2022-36897A missing permission check in Jenkins Compuware Xpediter Cod…4.3
• CVE-2022-36898A missing permission check in Jenkins Compuware ISPW Operati…4.3
• CVE-2022-36899Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier d…8.2
• CVE-2022-3690The Popup Maker WordPress plugin before 1.16.11 does not san…4.8
• CVE-2022-36900Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does…8.2
• CVE-2022-36901Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Req…6.5