PT-2022-14823 · Jenkins · Jenkins Mailer Plugin+1
Published
2022-01-12
·
Updated
2023-11-22
·
CVE-2022-20614
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Jenkins Mailer Plugin versions 391.ve4a 38c1b cf4b and earlier
Jenkins Mailer Plugin versions prior to 408.vd726a 1130320 and 1.34.2
Description
A missing permission check in the Jenkins Mailer Plugin allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname. This issue also results in a cross-site request forgery (CSRF) vulnerability because the form validation method does not require POST requests.
Recommendations
For Jenkins Mailer Plugin versions 391.ve4a 38c1b cf4b and earlier, update to version 408.vd726a 1130320 or 1.34.2 to require POST requests and Overall/Administer permission for the affected form validation method.
For Jenkins Mailer Plugin versions prior to 408.vd726a 1130320 and 1.34.2, update to version 408.vd726a 1130320 or 1.34.2 to require POST requests and Overall/Administer permission for the affected form validation method.
Fix
Missing Authorization
Incorrect Permission
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Jenkins
Jenkins Mailer Plugin