CVE-2022-36883

A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit...

Lack of authentication mechanism in Jenkins Git Plugin webhook

Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Gi...

GHSA-V878-67XW-GRW2 Lack of authentication mechanism in Jenkins Git Plugin webhook

Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Gi...

org.jenkins-ci.plugins:gitlab-plugin (>=1.1.6, <=1.1.28), org.jenkins-ci.plugins:salesforce-migration-assistant-plugin (>=2.2.0, <=2.2.2) +1 more potentially affected by CVE-2022-36884 via org.jenkins-ci.plugins:git (2.3.1)

org.jenkins-ci.plugins:git MAVEN version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:gitlab-plugin =1.1.6, =2.2.0, =1.3.0, =1.3.1 Source cves: CVE-2022-36884 Source...

org.biouno:uno-choice (>=1.0, <=1.4), org.jenkins-ci.plugins:git-server (1.3) +3 more potentially affected by CVE-2022-36882 via org.jenkins-ci.plugins:git (2.0.1)

org.jenkins-ci.plugins:git MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.biouno:uno-choice =1.0, =1.4 - org.jenkins-ci.plugins:git-server 1.3 - org.jenkins-ci.plugins:scriptler...

org.jenkins-ci.plugins:bitbucket-approval-filter (1.0.0), org.jenkins-ci.plugins:bitbucket-filter-project-trait (1.0) +7 more potentially affected by CVE-2022-36882 via org.jenkins-ci.plugins:git (3.6.0)

org.jenkins-ci.plugins:git MAVEN version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:bitbucket-approval-filter 1.0.0 -...

org.jenkins-ci.plugins:git-tag-message (>=1.0, <=1.5) potentially affected by CVE-2022-36882 via org.jenkins-ci.plugins:git (2.2.7)

org.jenkins-ci.plugins:git MAVEN version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:git-tag-message =1.0, =1.5 Source cves: CVE-2022-36882 Source advisory:...

org.jenkins-ci.plugins:fitnesse (>=1.12, <=1.13), org.jenkins-ci.plugins:gitbucket (>=0.1, <=0.4) potentially affected by CVE-2022-36883 via org.jenkins-ci.plugins:git (1.5.0)

org.jenkins-ci.plugins:git MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:fitnesse =1.12, =0.1, =0.4 Source cves: CVE-2022-36883 Source advisory:...

org.jenkins-ci.tools:git-parameter (>=0.4.0, <=0.6.2), org.jenkinsci.plugins.spoonscript:spoonscript (>=1.0, <=1.3) +1 more potentially affected by CVE-2022-36884 via org.jenkins-ci.plugins:git (2.3.4)

org.jenkins-ci.plugins:git MAVEN version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.tools:git-parameter =0.4.0, =1.0, =1.3 -...

Lack of authentication mechanism in Jenkins Git Plugin webhook

Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Gi...

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (>=2.1.0, <=2.1.2) potentially affected by CVE-2022-36882 via org.jenkins-ci.plugins:git (2.6.5)

org.jenkins-ci.plugins:git MAVEN version 2.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source =2.1.0, =2.1.2 Source cves: CVE-2022-36882 Source...

io.jenkins.blueocean:blueocean (>=1.0.0-b22, <=1.0.0-b24), io.jenkins.blueocean:blueocean-dashboard (>=1.0.0-b22, <=1.0.0-b24) +6 more potentially affected by CVE-2022-36883 via org.jenkins-ci.plugins:git (3.0.4)

org.jenkins-ci.plugins:git MAVEN version 3.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-b22, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22,...

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.0.0-beta-1), org.jenkins-ci.plugins:github-branch-source (2.0.0-beta-2) +1 more potentially affected by CVE-2022-36884 via org.jenkins-ci.plugins:git (2.6.2-beta-2)

org.jenkins-ci.plugins:git MAVEN version 2.6.2-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source 2.0.0-beta-1 -...

org.jenkins-ci.plugins:github-branch-source (2.0.0-beta-1), org.jenkins-ci.plugins:github-organization-folder (1.6-beta-1) +1 more potentially affected by CVE-2022-36884 via org.jenkins-ci.plugins:git (2.6.2-beta-1)

org.jenkins-ci.plugins:git MAVEN version 2.6.2-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:github-branch-source 2.0.0-beta-1 -...

org.jenkins-ci.tools:git-parameter (0.9.7) potentially affected by CVE-2022-36882 via org.jenkins-ci.plugins:git (3.9.1)

org.jenkins-ci.plugins:git MAVEN version 3.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.tools:git-parameter 0.9.7 Source cves: CVE-2022-36882 Source advisory: OSV:GHSA-8XWJ-2WGH-GP...

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (>=2.0.0, <=2.0.2-beta-1), org.jenkins-ci.plugins:github-branch-source (>=2.0.0, <=2.0.1-beta-6) +1 more potentially affected by CVE-2022-36882 via org.jenkins-ci.plugins:git (2.6.2)

org.jenkins-ci.plugins:git MAVEN version 2.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source =2.0.0, =2.0.0, =2.0.1-beta-6 -...

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.2.0-beta-1), org.jenkins-ci.plugins:github-branch-source (2.2.0-beta-1) potentially affected by CVE-2022-36883 via org.jenkins-ci.plugins:git (3.4.0-beta-1)

org.jenkins-ci.plugins:git MAVEN version 3.4.0-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source 2.2.0-beta-1 -...

org.jenkins-ci.plugins:git-bisect (>=1.0, <=1.3) potentially affected by CVE-2022-36883 via org.jenkins-ci.plugins:git (2.6.0)

org.jenkins-ci.plugins:git MAVEN version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:git-bisect =1.0, =1.3 Source cves: CVE-2022-36883 Source advisory:...

org.jenkins-ci.plugins:bitbucket-pullrequest-builder (>=1.4.29, <=1.5.0), org.jenkins-ci.plugins:coding-webhook (>=1.0.0, <=1.4.3) +3 more potentially affected by CVE-2022-36884 via org.jenkins-ci.plugins:git (2.4.1)

org.jenkins-ci.plugins:git MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:bitbucket-pullrequest-builder =1.4.29, =1.0.0, =1.0.11, =1.1.29, =2.4.0, =2.4.1 Sour...

org.jenkins-ci.plugins:git-tag-message (>=1.6, <=1.6.1) potentially affected by CVE-2022-36884 via org.jenkins-ci.plugins:git (2.5.0)

org.jenkins-ci.plugins:git MAVEN version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:git-tag-message =1.6, =1.6.1 Source cves: CVE-2022-36884 Source advisory:...