Lucene search

JenkinsCVE-2022-30969

HistoryMay 17, 2022 - 3:15 p.m.

CVE-2022-30969

2022-05-1715:15:11

CWE-352

jenkins

web.nvd.nist.gov

110

cve-2022-30969

csrf

jenkins autocomplete parameter plugin

nvd

security vulnerability

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

36.3%

JSON

A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without sandbox protection if the victim is an administrator.

Affected configurations

Nvd

Node

jenkinsautocomplete_parameterRange≤1.1jenkins

VendorProductVersionCPE
jenkinsautocomplete_parameter*cpe:2.3:a:jenkins:autocomplete_parameter:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	autocomplete_parameter	*	cpe:2.3:a:jenkins:autocomplete_parameter::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins Autocomplete Parameter Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "1.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unknown",
        "version": "next of 1.1",
        "versionType": "custom"
      }
    ]
  }
]

References

www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2322

Social References

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

36.3%

JSON

Related for CVE-2022-30969