PT-2022-19388 · Jenkins+1 · Jenkins Subversion Plugin+2

Daniel Beck + 1 · Published 2022-04-12 · Updated 2023-12-21 · CVE-2022-29048

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Subversion Plugin versions 2.15.3 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified URL. This issue arises because the Subversion Plugin does not require POST requests for several form validation methods, resulting in CSRF vulnerabilities.

Recommendations For Jenkins Subversion Plugin versions 2.15.3 and earlier, update the plugin to a version that addresses the CSRF vulnerability. As a temporary workaround, consider restricting access to the plugin's form validation methods to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-29048

GHSA-M5CW-C64P-77H6

Affected Products

Jenkins

Jenkins Subversion Plugin

Apple Macos

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2022-29048 · Security Note
• https://osv.dev/vulnerability/GHSA-m5cw-c64p-77h6 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-04-12/#SECURITY-2075 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29048 · Vendor Advisory
• https://github.com/jenkinsci/subversion-plugin/commit/882a7d359f6ac73c53d787bff4d62eba837001ea · Note
• https://github.com/jenkinsci/subversion-plugin · Note
• https://support.apple.com/en-us/HT213345 · Note
• https://t.me/cibsecurity/40702 · Telegram Post
• http://seclists.org/fulldisclosure/2022/Jul/18 · Note
• https://support.apple.com/kb/HT213345 · Note
• https://t.me/cvenotify/29232 · Telegram Post
• https://t.me/cvenotify/28798 · Telegram Post
• https://support.apple.com/en-us/102891 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29048 · Note
• https://t.me/cvenotify/33580 · Telegram Post