CVE-2022-45390: 
Java vulnerability analysis and mitigation

CVE-2022-45390 affects the loader.io Plugin version 1.0.1 and earlier for Jenkins. This vulnerability was discovered and reported by Valdes Che Zogou from CloudBees, Inc. and was publicly disclosed on November 15, 2022. The vulnerability affects the HTTP endpoint permission checks in the Jenkins loader.io Plugin (Jenkins Advisory, OSS Security).

The vulnerability stems from a missing permission check in an HTTP endpoint of the loader.io Plugin. The security issue is classified as Medium severity according to CVSS scoring system. The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs that are stored in Jenkins (Jenkins Advisory).

The vulnerability enables attackers with Overall/Read permission to enumerate credentials IDs stored in Jenkins. These enumerated credentials IDs can potentially be used as part of a broader attack to capture the actual credentials if combined with another vulnerability (Jenkins Advisory).

The vulnerability requires an attacker to have Overall/Read permission in the Jenkins system. Once this access level is obtained, the attacker can exploit the missing permission check in the HTTP endpoint to enumerate credentials IDs (Jenkins Advisory).

As of the advisory publication date, no fixes are available for this vulnerability in the loader.io Plugin. The plugin version 1.0.1 and earlier remain vulnerable (Jenkins Advisory).