medium4.3
CVE-2022-36886
External Monitor Job Type Plugin does not require POST requests for an HTTP endpoint
Impact
Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to create runs of an external job. External Monitor Job Type Plugin 192.ve979ca_8b_3ccd requires POST requests for the affected HTTP endpoint.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:external-monitor-job | <= 191.v363d0d1efdf8 | 192.ve979ca_8b_3ccd |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | External Monitor Job Type | through 191.v363d0d1efdf8 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2022/07/27/1
- https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2762
- https://github.com/advisories/GHSA-6x63-hrxg-2hjx
- https://nvd.nist.gov/vuln/detail/CVE-2022-36886
- https://github.com/jenkinsci/external-monitor-job-plugin/commit/e979ca8b3ccd8cf2b098533e1529d104b6bfd7da