CVE-2022-36896: 
Java vulnerability analysis and mitigation

CVE-2022-36896 affects the BMC AMI DevX Source Code Download for Endevor, PDS, and Code Pipeline Plugin versions 2.0.12 and earlier. The vulnerability was discovered and disclosed on July 27, 2022, and is classified as a medium severity issue (Jenkins Advisory).

The vulnerability stems from missing permission checks in several HTTP endpoints within the plugin. This security flaw allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs stored in Jenkins (Jenkins Advisory).

The vulnerability enables attackers to obtain credentials IDs that could be used as part of a broader attack to capture credentials using another vulnerability. This creates a potential security risk for Jenkins installations using the affected plugin versions (Jenkins Advisory).

The vulnerability has been fixed in BMC AMI DevX Source Code Download for Endevor, PDS, and Code Pipeline Plugin version 2.0.13. The updated version requires appropriate permissions to enumerate hosts and ports of Compuware configurations and credentials IDs (Jenkins Advisory).