Cross-Site Request Forgery Vulnerability in Jenkins External Monitor Job Type Plugin
CVE-2022-36886

4.3MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins External Monitor Job Type Plugin
Vendor
CVE Published:
27 July 2022

What is CVE-2022-36886?

A cross-site request forgery vulnerability has been identified in the Jenkins External Monitor Job Type Plugin, allowing attackers to craft requests that can create runs of external jobs without proper authentication. This could lead to unauthorized actions being executed within the Jenkins environment, compromising the integrity and security of the CI/CD pipeline. Users of affected plugin versions are urged to review their security configurations and apply necessary precautions.

Affected Version(s)

Jenkins External Monitor Job Type Plugin <= 191.v363d0d1efdf8

Jenkins External Monitor Job Type Plugin 1.7.1

References

https://www.jenkins.io/security/advisory/2022-07-27/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2022/07/27/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.