Lucene search

GoogleOSV:GHSA-6X63-HRXG-2HJX

HistoryJul 28, 2022 - 12:00 a.m.

External Monitor Job Type Plugin does not require POST requests for an HTTP endpoint

2022-07-2800:00:43

Google

osv.dev

jenkins

http

endpoint

csrf

vulnerability

external job

plugin

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

38.5%

JSON

Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to create runs of an external job.

External Monitor Job Type Plugin 192.ve979ca_8b_3ccd requires POST requests for the affected HTTP endpoint.

References

www.openwall.com/lists/oss-security/2022/07/27/1

github.com/jenkinsci/external-monitor-job-plugin/commit/e979ca8b3ccd8cf2b098533e1529d104b6bfd7da

nvd.nist.gov/vuln/detail/CVE-2022-36886

www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2762

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

38.5%

JSON

Related for OSV:GHSA-6X63-HRXG-2HJX