PT-2022-27501 · Jenkins · Jenkins Cluster Statistics Plugin+1

Cc Bomber · Published 2022-11-15 · Updated 2023-11-01 · CVE-2022-45399

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Cluster Statistics Plugin versions 0.4.6 and earlier

Description A missing permission check in the Jenkins Cluster Statistics Plugin allows attackers to delete recorded Jenkins Cluster Statistics. This issue is related to an HTTP endpoint that does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. Attackers with Overall/Read permission can exploit this issue.

Recommendations For Jenkins Cluster Statistics Plugin versions 0.4.6 and earlier, as a temporary workaround, consider restricting access to the affected HTTP endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-45399

GHSA-W8WG-62WF-62GM

Affected Products

Jenkins

Jenkins Cluster Statistics Plugin

References · 6

• https://jenkins.io/security/advisory/2022-11-15/#SECURITY-2938 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45399 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45399 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w8wg-62wf-62gm · Vendor Advisory
• https://t.me/cvenotify/38031 · Telegram Post
• http://openwall.com/lists/oss-security/2022/11/15/4 · Note