PT-2022-25764 · Jenkins · Jenkins Scm Httpclient Plugin+1

Valdes Che Zogou · Published 2022-09-21 · Updated 2023-11-01 · CVE-2022-41249

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins SCM HttpClient Plugin versions 1.5 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs, capturing credentials stored in Jenkins. The vulnerability is due to a lack of permission check in a method implementing form validation, which can be exploited by attackers with Overall/Read permission. This form validation method does not require POST requests, resulting in the CSRF vulnerability.

Recommendations For Jenkins SCM HttpClient Plugin versions 1.5 and earlier, consider disabling the plugin until a patch is available to prevent attackers from exploiting the CSRF vulnerability. Restrict access to the form validation method to minimize the risk of exploitation. Avoid using the credentials IDs in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-41249

GHSA-6CVR-RVPM-9WX4

Affected Products

Jenkins

Jenkins Scm Httpclient Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-41249 · Security Note
• https://jenkins.io/security/advisory/2022-09-21/#SECURITY-2708 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6cvr-rvpm-9wx4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41249 · Vendor Advisory
• https://github.com/jenkinsci/scm-httpclient-plugin · Note
• http://openwall.com/lists/oss-security/2022/09/21/5 · Note
• https://t.me/cibsecurity/50207 · Telegram Post