Cross-Site Request Forgery Vulnerability in Jenkins External Monitor Job Type Plugin
CVE-2022-36886

4.3MEDIUM

Key Information:

Vendor
Jenkins
Vendor
CVE Published:
27 July 2022

Summary

A cross-site request forgery vulnerability has been identified in the Jenkins External Monitor Job Type Plugin, allowing attackers to craft requests that can create runs of external jobs without proper authentication. This could lead to unauthorized actions being executed within the Jenkins environment, compromising the integrity and security of the CI/CD pipeline. Users of affected plugin versions are urged to review their security configurations and apply necessary precautions.

Affected Version(s)

Jenkins External Monitor Job Type Plugin <= 191.v363d0d1efdf8

Jenkins External Monitor Job Type Plugin 1.7.1

References

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.