Medium · 4.3 CVE-2022-36886 EUVD-2022-6266GHSA-6x63-hrxg-2hjx

External Monitor Job Type Plugin does not require POST requests for an HTTP endpoint

Published Jul 27, 2022 · Updated Aug 3, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins External Monitor Job Type Plugin Package: org.jenkins-ci.plugins:external-monitor-job Category: Web / CMS Ecosystem: Maven

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier allows attackers to create runs of an external job.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins External Monitor Job Type Plugin	unspecified – ≤ 191.v363d0d1efdf8	1.7.1

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins:external-monitor-job	< 192.ve979ca_8b_3ccd	192.ve979ca_8b_3ccd	GHSA-6x63-hrxg-2hjx

Advisories 1

WID-SEC-2022-0852 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 12, 2023

References

https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2762
[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins mailing-list