Cross-Site Request Forgery Vulnerability in Jenkins Sonar Gerrit Plugin by Jenkins
CVE-2022-46688

6.5MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Sonar Gerrit Plugin
Vendor
CVE Published:
12 December 2022

Summary

A cross-site request forgery vulnerability exists in the Jenkins Sonar Gerrit Plugin versions up to 377.v8f3808963dc5. This flaw enables attackers to compel Jenkins to connect to an arbitrary Gerrit server, using user-defined credential IDs. Such exploitation could lead to unauthorized access and potential compromise of sensitive credentials stored within Jenkins.

Affected Version(s)

Jenkins Sonar Gerrit Plugin <= 377.v8f3808963dc5

References

https://www.jenkins.io/security/advisory/2022-12-07/#SECU...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.