Jenkins project Jenkins
At a glance
- Source
- NVD
- EPSS
- EPSS 1.81 % · percentile 79 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- jenkins
- NVD status
- Modified
Description
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.
Weaknesses (CWE)
- CWE-352 — Cross-Site Request Forgery
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 2.6 | AV:N/AC:H/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-p92q-7fhh-mq35 — Cross-Site Request Forgery in Jenkins
European references
- ENISA EUVD · EUVD-2022-0661
- GCVE · GCVE-0-2022-20612
Affected configurations (NVD CPE)
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*≤ 2.319.1cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*≤ 2.329cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Jenkins project · Jenkins | affected unspecified ≤ 2.329 ; affected unspecified ≤ LTS 2.319.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |