medium5.4
CVE-2022-36908
CSRF vulnerability in Jenkins OpenShift Deployer Plugin
Impact
OpenShift Deployer Plugin 1.2.0 and earlier does not perform permission checks in methods implementing form validation. These form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:openshift-deployer | <= 1.2.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Openshift Deployer | through 1.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2022/07/27/1
- https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1375%20%282%29
- https://github.com/advisories/GHSA-5mv2-vqq7-mq5h
- https://nvd.nist.gov/vuln/detail/CVE-2022-36908
- https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1375%20(2)