Cross-Site Request Forgery in Jenkins SSH Plugin Affects Multiple Versions

CVE-2022-30958

Summary

The Jenkins SSH Plugin has a vulnerability that allows an attacker to exploit cross-site request forgery, potentially enabling unauthorized access. By manipulating the user's request, the attacker can specify an SSH server and use stolen credential IDs, which may have been captured through other means. This vulnerability primarily affects users who have not implemented adequate security measures, putting sensitive SSH credentials at risk.

References