CVE-2022-41238

2022-09-2116:15:10

CWE-862

[email protected]

web.nvd.nist.gov

cve-2022-41238

jenkins

dotci plugin

permission check

unauthenticated attackers

build trigger

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

62.2%

JSON

A missing permission check in Jenkins DotCi Plugin 2.40.00 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits.

Affected configurations

NVD

Node

jenkinsdotciRange≤2.40.00jenkins

CPENameOperatorVersion
jenkins:dotcijenkins dotcile2.40.00

CPE	Name	Operator	Version
jenkins:dotci	jenkins dotci	le	2.40.00

CNA Affected

[
  {
    "product": "Jenkins DotCi Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "2.40.00",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unknown",
        "version": "next of 2.40.00",
        "versionType": "custom"
      }
    ]
  }
]