{"id":"CVE-2022-20620","details":"Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins.","aliases":["GHSA-9wxh-jjj5-67cv"],"modified":"2026-07-09T03:25:43.810826Z","published":"2022-01-12T20:15:09.057Z","references":[{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2022/01/12/6"},{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2189"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/ssh-agent-plugin","events":[{"introduced":"0"},{"last_affected":"cb16f71724bad639dd2a53ba8984294559dbfed9"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"1.23"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:jenkins:ssh_agent:*:*:*:*:*:jenkins:*:*"}}],"versions":["ssh-agent-1.23","ssh-agent-1.22","ssh-agent-1.21","ssh-agent-1.20","ssh-agent-1.19","ssh-agent-1.18","ssh-agent-1.17","ssh-agent-1.16","ssh-agent-1.15","ssh-agent-1.14","ssh-agent-1.13","ssh-agent-1.12","ssh-agent-1.11","ssh-agent-1.10","ssh-agent-1.9","ssh-agent-1.8","ssh-agent-1.7","ssh-agent-1.6","ssh-agent-1.5","ssh-agent-1.4.1","ssh-agent-1.4","ssh-agent-1.3","ssh-agent-1.2","ssh-agent-1.1","ssh-agent-1.0","ssh-agent-0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-20620.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}