PT-2022-4029 · Jenkins · Jenkins Job Configuration History Plugin+1

Wadeck Follonier · Published 2022-07-27 · Updated 2023-11-22 · CVE-2022-36887

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Job Configuration History Plugin versions 1155.v28a 46a cc06a 5 and earlier

Description The issue is related to a cross-site request forgery (CSRF) vulnerability. This vulnerability can be exploited by a remote attacker to perform a CSRF attack, allowing them to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations.

Recommendations For Jenkins Job Configuration History Plugin versions 1155.v28a 46a cc06a 5 and earlier, update to version 1156.v536a 97b 8d649 or later, which requires POST requests for the affected HTTP endpoints, mitigating the CSRF vulnerability. At the moment, there is no other information about additional mitigation measures for this vulnerability.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2022-04862

CVE-2022-36887

GHSA-J896-J72W-CR32

Affected Products

Jenkins

Jenkins Job Configuration History Plugin

References · 9

• https://jenkins.io/security/advisory/2022-07-27/#SECURITY-2766 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36887 · Security Note
• https://bdu.fstec.ru/vul/2022-04862 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36887 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j896-j72w-cr32 · Vendor Advisory
• https://github.com/jenkinsci/job-config-history-plugin/commit/536a97b8d649b3114f5db24ea32a7c63188a35c6 · Note
• https://t.me/cibsecurity/47109 · Telegram Post
• http://openwall.com/lists/oss-security/2022/07/27/1 · Note
• https://t.me/cvenotify/33856 · Telegram Post