CVE-2022-30951

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access control, potentially allowing users to start processes even if they're not allowed to log in.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins WMI Windows Agents Plugin	>= unspecified, <= 1.8

References

http://www.openwall.com/lists/oss-security/2022/05/17/8Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2604Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/05/17/8Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2604Vendor Advisory

Timeline

Published: May 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-309526.5Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with CVE-2022-309536.5A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker CVE-2022-309546.5Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/CVE-2022-309556.5Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permi CVE-2022-309565.4Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scr CVE-2022-309574.3A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID CVE-2022-309588.8A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specifi CVE-2022-309596.5A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-s CVE-2022-30965.4The WP Total Hacks WordPress plugin through 4.7.2 does not prevent low privilege users from modifying the plugin's settings. This could allo CVE-2022-309605.4Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying p CVE-2022-309615.4Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters CVE-2022-309625.4Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameter