PT-2022-25746 · Jenkins · Jenkins Build-Publisher Plugin+1

Matt Sicker · Published 2022-09-21 · Updated 2025-05-28 · CVE-2022-41230

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Build-Publisher Plugin versions 1.22 and earlier

Description The issue is related to a missing permission check in an HTTP endpoint, which allows attackers with Overall/Read permission to obtain the names and URLs of Jenkins servers that the plugin is configured to publish builds to, as well as builds pending for publication to those Jenkins servers.

Recommendations For Jenkins Build-Publisher Plugin versions 1.22 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the affected HTTP endpoint until a patch is available. Avoid using the plugin until the issue is resolved.

Incorrect Authorization

Missing Authorization

Weakness Enumeration

CWE-863

CWE-862

Related Identifiers

CVE-2022-41230

GHSA-3JP6-Q9CG-RVGJ

Affected Products

Jenkins

Jenkins Build-Publisher Plugin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2022-41230 · Security Note
• https://jenkins.io/security/advisory/2022-09-21/#SECURITY-1994 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3jp6-q9cg-rvgj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41230 · Vendor Advisory
• https://github.com/jenkins-infra/update-center2/pull/644 · Note
• https://t.me/cvenotify/123863 · Telegram Post
• https://plugins.jenkins.io/build-publisher · Note
• https://t.me/cvenotify/36667 · Telegram Post
• https://t.me/cibsecurity/50211 · Telegram Post
• https://t.me/cvenotify/60322 · Telegram Post