CVE-2022-30955: 
Java vulnerability analysis and mitigation

CVE-2022-30955 is a security vulnerability discovered in the Jenkins GitLab Plugin versions 1.5.31 and earlier, disclosed on May 17, 2022. The vulnerability is related to a missing permission check in an HTTP endpoint that could allow unauthorized access to credential information (Jenkins Advisory).

The vulnerability has been classified with a Medium severity CVSS score. The core issue stems from the GitLab Plugin's failure to perform proper permission checks in an HTTP endpoint, which creates a security gap in the authentication process (Jenkins Advisory).

This vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. The exposed credentials IDs could potentially be used as part of a broader attack to capture the actual credentials using another vulnerability (Jenkins Advisory).

The vulnerability can be exploited by attackers who have Overall/Read permission in the Jenkins system. The attack vector requires access to the affected HTTP endpoint in the GitLab Plugin (Jenkins Advisory).

The vulnerability has been fixed in GitLab Plugin version 1.5.32. In this updated version, the enumeration of credentials IDs requires appropriate permissions, effectively closing the security gap. Users are advised to upgrade to this version or later to mitigate the vulnerability (Jenkins Advisory).