CVE-2022-34782: 
Java vulnerability analysis and mitigation

CVE-2022-34782 is a security vulnerability discovered in the Jenkins requests-plugin Plugin affecting versions 2.2.16 and earlier. The vulnerability was disclosed on June 30, 2022, as part of the Jenkins Security Advisory. This vulnerability is related to incorrect permission checks in the plugin that could allow unauthorized access to pending requests information (Jenkins Advisory).

The vulnerability stems from an incorrect implementation of permission checks in an HTTP endpoint within the requests-plugin Plugin. The issue is classified as having Medium severity with a CVSS v3.1 base score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). This vulnerability is essentially a recurrence of a previous security issue (SECURITY-1995) whose fix proved ineffective (NVD).

The vulnerability allows attackers who have Overall/Read permission to view the list of pending requests, potentially exposing sensitive information that should only be accessible to administrators (Jenkins Advisory).

The vulnerability has been fixed in requests-plugin Plugin version 2.2.17, which properly implements permission checks requiring Overall/Administer permission to view the list of pending requests. Users are advised to upgrade to this version to mitigate the vulnerability (Jenkins Advisory).