Technical impact
The vulnerability arises from a missing permission check in the Jenkins Contrast Continuous Application Security Plugin, identified as CWE-862. It permits any user with Overall/Read rights to enumerate all configured Contrast metadata names, leading to unintended information disclosure. The weakness reflects improper access control and information leakage, affecting the confidentiality of plugin configuration data.
Affected Systems
The flaw affects customers using Jenkins Project’s Contrast Continuous Application Security Plugin version 3.11 or earlier; no other versions or related products are known to be impacted.
Risk and Exploitability
The vulnerability can be exploited by any account that holds Overall/Read permission, generally associated with privileged or administrator roles. The likely attack vector is through the Jenkins web interface or API endpoints that expose metadata names; based on the description, it is inferred that an attacker would need access to the instance with at least Overall/Read rights. The CVSS score of 4.3, the EPSS score is less than 1 %, and the issue is not listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. Nevertheless, any compromise of Overall/Read permissions—potentially via internal access or misconfiguration—could allow enumeration of sensitive configuration details.
Github GHSA