CVE-2022-45383

An incorrect permission check in Jenkins Support Core Plugin 1206.v14049fa_b_d860 and earlier allows attackers with Support/DownloadBundle permission to download a previously created support bundle containing information limited to users with Overall/Administer permission.

• CWE-863
• CWE-863

• http://www.openwall.com/lists/oss-security/2022/11/15/4Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2804Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/11/15/4Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2804Vendor Advisory

Published

Nov 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-45378In the default configuration of Apache SOAP, an RPCRouterSer…9.8
• CVE-2022-45379Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and ear…7.5
• CVE-2022-4538Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2022-45380Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier convert…5.4
• CVE-2022-45381Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier doe…8.1
• CVE-2022-45382Jenkins Naginator Plugin 1.18.1 and earlier does not escape …5.4
• CVE-2022-45384Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores t…6.5
• CVE-2022-45385A missing permission check in Jenkins CloudBees Docker Hub/R…7.5
• CVE-2022-45386Jenkins Violations Plugin 0.7.11 and earlier does not config…5.5
• CVE-2022-45387Jenkins BART Plugin 1.0.3 and earlier does not escape the pa…5.4
• CVE-2022-45388Jenkins Config Rotator Plugin 2.0.1 and earlier does not res…7.5
• CVE-2022-45389A missing permission check in Jenkins XP-Dev Plugin 1.0 and …5.3