Support Core Plugin defines the permission Support/DownloadBundle that allows users without Overall/Administer permission to create and download support bundles containing a limited set of diagnostic information.

Support Core Plugin 1206.v14049fa_b_d860 and earlier does not correctly perform permission checks in several HTTP endpoints.

This allows attackers with Support/DownloadBundle permission to download a previously created support bundle containing information limited to users with Overall/Administer permission.

Support Core Plugin 1206.1208.v9b_7a_1d48db_0f deprecates the Support/DownloadBundle permission. The Overall/Administer permission is now required to download support bundles.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-45383
• https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2804
• http://www.openwall.com/lists/oss-security/2022/11/15/4
• jenkinsci/support-core-plugin@9b7a1d4