CVE-2022-36892: 
Java vulnerability analysis and mitigation

CVE-2022-36892 affects the rhnpush-plugin Plugin for Jenkins, discovered and disclosed on July 27, 2022. The vulnerability impacts versions 0.5.1 and earlier of the plugin. This is a medium severity vulnerability related to missing permission checks in form validation methods (Jenkins Advisory).

The vulnerability stems from a missing permission check in a method implementing form validation in the rhnpush-plugin Plugin. The issue allows attackers with Item/Read permission, but without Item/Workspace or Item/Configure permission, to check whether attacker-specified file patterns match workspace contents (Jenkins Advisory).

Through this vulnerability, attackers can effectively list workspace contents by using a sequence of requests. This could potentially expose sensitive information stored in the Jenkins workspace to unauthorized users (Jenkins Advisory).

The vulnerability has been fixed in rhnpush-plugin Plugin version 0.5.2, which requires Item/Workspace permission to validate patterns with workspace contents. Users should upgrade to this version to mitigate the vulnerability (Jenkins Advisory).