GitHub Advisoryadvisory · Maven

GHSA-p92q-7fhh-mq35 Cross-Site Request Forgery in Jenkins

MEDIUM Published 2022-01-21 Modified 2023-10-27 Official page ↗
Aliases
CVE-2022-20612
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-352
Reviewed
2022-01-20

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 2.320, < 2.330 → fixed in 2.330 • Maven org.jenkins-ci.main:jenkins-core: < 2.319.2 → fixed in 2.319.2

Description

Jenkins 2.329 and earlier, LTS 2.319.1 and earlier does not require POST requests for the HTTP endpoint handling manual build requests when no security realm is set, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to trigger build of job without parameters. Jenkins 2.330, LTS 2.319.2 requires POST requests for the affected HTTP endpoint.

Related

Alias · CVE (1)

  • CVE-2022-20612 A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References