BIT-jenkins-2022-20612

vendorUSosv

view advisory published 2024-03-06Licence: per source

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-20612US	medium4.3	1.81% (79th)	—	2022-01-12
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2022/01/12/6ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2022-20612WEB
https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2558ADVISORY
https://www.oracle.com/security-alerts/cpuapr2022.htmlADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan