CVE-2022-46688

2022-12-1209:15:13

Google

osv.dev

cve-2022-46688

jenkins

sonar

gerrit

csrf

vulnerability

plugin

credentials

security

software

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

30.4%

JSON

A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers (previously configured by Jenkins administrators) using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.

CPENameOperatorVersion
sonar-gerrit-plugineqsonar-gerrit-1.0.2
sonar-gerrit-plugineqsonar-gerrit-1.0.7
sonar-gerrit-plugineq370.vf2cf40f43d41
sonar-gerrit-plugineqsonar-gerrit-2.4.2
sonar-gerrit-plugineq361.v3f45367a_71da_
sonar-gerrit-plugineqsonar-gerrit-1.0.7.5
sonar-gerrit-plugineqsonar-gerrit-1.0.7.4
sonar-gerrit-plugineqsonar-gerrit-1.0.5
sonar-gerrit-plugineqsonar-gerrit-2.4.1
sonar-gerrit-plugineq1.0

Name	Operator	Version
sonar-gerrit-plugin	eq	sonar-gerrit-1.0.2
sonar-gerrit-plugin	eq	sonar-gerrit-1.0.7
sonar-gerrit-plugin	eq	370.vf2cf40f43d41
sonar-gerrit-plugin	eq	sonar-gerrit-2.4.2
sonar-gerrit-plugin	eq	361.v3f45367a_71da_
sonar-gerrit-plugin	eq	sonar-gerrit-1.0.7.5
sonar-gerrit-plugin	eq	sonar-gerrit-1.0.7.4
sonar-gerrit-plugin	eq	sonar-gerrit-1.0.5
sonar-gerrit-plugin	eq	sonar-gerrit-2.4.1
sonar-gerrit-plugin	eq	1.0