CVE-2022-46688

2022-12-1209:15:13

CWE-352

jenkins

web.nvd.nist.gov

cve-2022-46688

nvd

jenkins

sonar

gerrit

csrf

vulnerability

security

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

30.4%

JSON

A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers (previously configured by Jenkins administrators) using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.

Affected configurations

Nvd

Node

jenkinssonar_gerritRange≤377.v8f3808963dc5jenkins

VendorProductVersionCPE
jenkinssonar_gerrit*cpe:2.3:a:jenkins:sonar_gerrit:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	sonar_gerrit	*	cpe:2.3:a:jenkins:sonar_gerrit::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins Sonar Gerrit Plugin",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThanOrEqual": "377.v8f3808963dc5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unknown",
        "version": "next of 377.v8f3808963dc5",
        "versionType": "custom"
      }
    ]
  }
]