Cross-Site Request Forgery Vulnerability in Jenkins External Monitor Job Type Plugin
CVE-2022-36886
4.3MEDIUM
Key Information:
- Vendor
- Jenkins
- Vendor
- CVE Published:
- 27 July 2022
Summary
A cross-site request forgery vulnerability has been identified in the Jenkins External Monitor Job Type Plugin, allowing attackers to craft requests that can create runs of external jobs without proper authentication. This could lead to unauthorized actions being executed within the Jenkins environment, compromising the integrity and security of the CI/CD pipeline. Users of affected plugin versions are urged to review their security configurations and apply necessary precautions.
Affected Version(s)
Jenkins External Monitor Job Type Plugin <= 191.v363d0d1efdf8
Jenkins External Monitor Job Type Plugin 1.7.1
References
CVSS V3.1
Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved