Lucene search

[email protected]CVE-2022-28136

HistoryMar 29, 2022 - 1:15 p.m.

CVE-2022-28136

2022-03-2913:15:08

CWE-352

[email protected]

web.nvd.nist.gov

cve-2022-28136

cross-site request forgery

csrf vulnerability

jenkins jiratestresultreporter plugin

security

nvd

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.5%

JSON

A cross-site request forgery (CSRF) vulnerability in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.

Affected configurations

NVD

Node

jenkinsjiratestresultreporterRange≤165.v817928553942jenkins

CPENameOperatorVersion
jenkins:jiratestresultreporterjenkins jiratestresultreporterle165.v817928553942

CPE	Name	Operator	Version
jenkins:jiratestresultreporter	jenkins jiratestresultreporter	le	165.v817928553942

CNA Affected

[
  {
    "product": "Jenkins JiraTestResultReporter Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "165.v817928553942",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]