Cross-Site Request Forgery Vulnerability in Jenkins Storable Configs Plugin

CVE-2022-30972

What is CVE-2022-30972?

The Jenkins Storable Configs Plugin prior to version 1.1 is susceptible to a cross-site request forgery (CSRF) vulnerability. This weakness enables attackers to exploit the plugin's handling of local XML files, specifically allowing for unauthorized parsing of these files. By leveraging external entities within the XML, an attacker can extract sensitive information from the Jenkins controller or perform unauthorized server-side requests. As a result, this vulnerability poses a threat to the confidentiality and integrity of data managed by Jenkins.

References