CVE-2022-41230

Published Sep 21, 2022

Last updated a year ago

CVSS medium 4.3

Overview

Description: Jenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain names and URLs of Jenkins servers that the plugin is configured to publish builds to, as well as builds pending for publication to those Jenkins servers.
Source: jenkinsci-cert@googlegroups.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.3
Impact score: 1.4
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-862

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:jenkins:build-publisher:*:*:*:*:*:jenkins:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9E1FEB31-AC20-4570-B196-B7A030C64346",
            "versionEndIncluding": "1.22"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References