CVE-2022-41245

2022-09-2116:15:11

Alpine Linux Development Team

security.alpinelinux.org

csrf

jenkins

worksoft execution manager plugin

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

36.3%

JSON

A cross-site request forgery (CSRF) vulnerability in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

OSVersionArchitecturePackageVersionFilename
Alpine3.16-communitynoarchjenkins= 2.346.2-r0UNKNOWN
Alpine3.17-communitynoarchjenkins= 2.361.2-r0UNKNOWN
Alpine3.18-communitynoarchjenkins= 2.387.3-r0UNKNOWN
Alpine3.19-communitynoarchjenkins= 2.440.3-r0UNKNOWN
Alpine3.20-communitynoarchjenkins= 2.440.2-r0UNKNOWN
Alpineedge-communitynoarchjenkins= 2.462.1-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	3.16-community	noarch	jenkins	= 2.346.2-r0	UNKNOWN
Alpine	3.17-community	noarch	jenkins	= 2.361.2-r0	UNKNOWN
Alpine	3.18-community	noarch	jenkins	= 2.387.3-r0	UNKNOWN
Alpine	3.19-community	noarch	jenkins	= 2.440.3-r0	UNKNOWN
Alpine	3.20-community	noarch	jenkins	= 2.440.2-r0	UNKNOWN
Alpine	edge-community	noarch	jenkins	= 2.462.1-r0	UNKNOWN