Cross-Site Request Forgery Vulnerability in Jenkins SCM HttpClient Plugin

CVE-2022-41249

Summary

The Jenkins SCM HttpClient Plugin suffers from a Cross-Site Request Forgery vulnerability that allows attackers to send unauthorized HTTP requests using the credentials of authenticated users. By exploiting this flaw, an attacker can redirect requests to a malicious HTTP server, enabling them to capture sensitive credentials stored within Jenkins. This risk particularly affects versions 1.5 and earlier of the SCM HttpClient Plugin, emphasizing the importance of applying security updates to mitigate the threat.

References