Cross-Site Request Forgery Vulnerability in Jenkins SCM HttpClient Plugin
CVE-2022-41249

8.8HIGH

Key Information:

Vendor

Jenkins
Status
Jenkins Scm Httpclient Plugin
Vendor
CVE Published:
21 September 2022

What is CVE-2022-41249?

The Jenkins SCM HttpClient Plugin suffers from a Cross-Site Request Forgery vulnerability that allows attackers to send unauthorized HTTP requests using the credentials of authenticated users. By exploiting this flaw, an attacker can redirect requests to a malicious HTTP server, enabling them to capture sensitive credentials stored within Jenkins. This risk particularly affects versions 1.5 and earlier of the SCM HttpClient Plugin, emphasizing the importance of applying security updates to mitigate the threat.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Jenkins SCM HttpClient Plugin <= 1.5

References

https://www.jenkins.io/security/advisory/2022-09-21/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2022/09/21/5
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.