CVE-2022-30957: 
Java vulnerability analysis and mitigation

CVE-2022-30957 is a security vulnerability discovered in Jenkins SSH Plugin version 2.6.1 and earlier, identified as SECURITY-2315. The vulnerability was disclosed on May 17, 2022, affecting the SSH Plugin's permission checking mechanism. This vulnerability impacts Jenkins installations using the affected versions of the SSH Plugin (Jenkins Advisory).

The vulnerability stems from a missing permission check in an HTTP endpoint within the SSH Plugin. The severity of this vulnerability is rated as Medium according to the CVSS scoring system. The technical issue specifically relates to inadequate access control implementation in the plugin's HTTP endpoint functionality (Jenkins Advisory).

The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. These enumerated credentials IDs could potentially be used as part of a broader attack to capture the credentials using another vulnerability (Jenkins Advisory).

The vulnerability can be exploited by attackers who have Overall/Read permission in the Jenkins installation. The attack vector requires access to the affected HTTP endpoint in the SSH Plugin (Jenkins Advisory).

As of the advisory's publication date, there was no fix available for this vulnerability in the SSH Plugin. Users running affected versions (2.6.1 and earlier) should monitor for updates and consider implementing additional access controls at the Jenkins instance level (Jenkins Advisory).