CVE-2022-34810: 
Java vulnerability analysis and mitigation

A missing permission check vulnerability was discovered in Jenkins RQM Plugin version 2.8 and earlier, identified as CVE-2022-34810. The vulnerability was disclosed on June 30, 2022, and affects the RQM Plugin's HTTP endpoint functionality. This security issue allows attackers with Overall/Read permission to enumerate credentials IDs stored in Jenkins (Jenkins Advisory).

The vulnerability stems from a missing permission check in an HTTP endpoint within the RQM Plugin. The security flaw has been classified with a Medium severity CVSS rating. The vulnerability specifically affects the authentication and authorization mechanisms of the plugin, allowing unauthorized access to credential information (Jenkins Advisory).

The vulnerability enables attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. These enumerated credentials IDs can potentially be used as part of a broader attack to capture the credentials using another vulnerability (Jenkins Advisory).

As of the advisory's publication date, there was no fix available for this vulnerability in the RQM Plugin. Users running version 2.8 or earlier of the plugin remain vulnerable to this security issue (Jenkins Advisory).