PT-2022-20400 · Jenkins · Jenkins Script Security Plugin+1

Published 2022-05-17 · Updated 2023-12-22 · CVE-2022-30946

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1158.v7c1b 73a 69a 08 and earlier

Description A cross-site request forgery (CSRF) issue allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver. This occurs because the plugin does not properly validate requests, enabling an attacker to forge requests that Jenkins will execute.

Recommendations For Jenkins Script Security Plugin versions 1158.v7c1b 73a 69a 08 and earlier, consider disabling the plugin until a patch is available to prevent potential exploitation. Restrict access to the Jenkins interface to minimize the risk of CSRF attacks.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-30946

GHSA-QWGX-MRV5-87J8

RHSA-2023:0017

RHSA-2023:0560

RHSA-2023:0777

Affected Products

Jenkins

Jenkins Script Security Plugin

References · 8

• https://osv.dev/vulnerability/GHSA-qwgx-mrv5-87j8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30946 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30946 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-05-17/#SECURITY-2116 · Vendor Advisory
• https://github.com/jenkinsci/script-security-plugin · Note
• https://github.com/jenkinsci/script-security-plugin/commit/35f6a0b8207ed3a32a85f27c1312da6cd738eeaa · Note
• http://openwall.com/lists/oss-security/2022/05/17/8 · Note
• https://t.me/cvenotify/64911 · Telegram Post