Cross-Site Request Forgery Vulnerability in Jenkins Jianliao Notification Plugin
CVE-2022-34205

6.5MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Jianliao Notification Plugin
Vendor
CVE Published:
23 June 2022

Summary

A cross-site request forgery vulnerability exists in the Jenkins Jianliao Notification Plugin version 1.1 and earlier. This flaw enables attackers to issue HTTP POST requests to a targeted URL, which may lead to unauthorized actions within Jenkins by tricking users into inadvertently executing malicious requests. It is crucial for users of this plugin to update to a secure version and implement protective measures against CSRF to safeguard their Jenkins environments.

Affected Version(s)

Jenkins Jianliao Notification Plugin <= 1.1

References

https://www.jenkins.io/security/advisory/2022-06-22/#SECU...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.