CVE-2022-36906

2022-07-2715:15:10

CWE-352

jenkins

web.nvd.nist.gov

cve

2022

36906

csrf

vulnerability

jenkins

openshift

deployer

plugin

nvd

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

35.1%

JSON

A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password.

Affected configurations

Nvd

Node

jenkinsopenshift_deployerRange≤1.2.0jenkins

VendorProductVersionCPE
jenkinsopenshift_deployer*cpe:2.3:a:jenkins:openshift_deployer:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	openshift_deployer	*	cpe:2.3:a:jenkins:openshift_deployer::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins OpenShift Deployer Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "1.2.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unknown",
        "version": "next of 1.2.0",
        "versionType": "custom"
      }
    ]
  }
]