PT-2022-6109 · Jenkins · Jenkins Tuleap Git Branch Source Plugin+1

Kevin Guerroudj · Published 2022-10-19 · Updated 2025-05-08 · CVE-2022-43421

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Tuleap Git Branch Source Plugin versions 3.2.4 and earlier

Description The issue is related to a missing permission check in the Jenkins Tuleap Git Branch Source Plugin, allowing unauthenticated attackers to trigger Tuleap projects. This can be achieved when the configured repository matches the attacker-specified value. The vulnerability is also associated with insufficient authorization procedures when handling the /tuleap-hook/ endpoint, potentially allowing remote attackers to gain unauthorized access to protected information.

Recommendations For Jenkins Tuleap Git Branch Source Plugin versions 3.2.4 and earlier, consider updating to version 3.2.5 or later, which requires a token to access the webhook endpoint, thereby mitigating the risk of unauthorized access. As a temporary workaround, consider restricting access to the /tuleap-hook/ endpoint to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2023-00049

CVE-2022-43421

GHSA-73V5-W6FG-2M44

Affected Products

Jenkins

Jenkins Tuleap Git Branch Source Plugin

References · 7

• https://bdu.fstec.ru/vul/2023-00049 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-43421 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43421 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-10-19/#SECURITY-2852 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-73v5-w6fg-2m44 · Vendor Advisory
• http://openwall.com/lists/oss-security/2022/10/19/3 · Note
• https://t.me/cvenotify/121435 · Telegram Post