critical9.8
CVE-2022-41238
Lack of authentication mechanism in Jenkins DotCi Plugin webhook
Impact
DotCi Plugin provides a webhook endpoint at `/githook/` that can be used to trigger builds of the job for a GitHub repository. In DotCi Plugin 2.40.00 and earlier, this endpoint can be accessed without authentication. This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits. This plugin has been suspended.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.groupon.jenkins-ci.plugins:DotCi | <= 2.40.00 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Dotci | through 2.40.00 |