Jenkins project Jenkins
En bref
- Source
- NVD
- EPSS
- EPSS 1.81 % · centile 79 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- jenkins
- Statut NVD
- Modified
Description
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.
Faiblesses (CWE)
- CWE-352 — Falsification de requête inter-site (CSRF)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 2.6 | AV:N/AC:H/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-p92q-7fhh-mq35 — Cross-Site Request Forgery in Jenkins
Références européennes
- ENISA EUVD · EUVD-2022-0661
- GCVE · GCVE-0-2022-20612
Configurations affectées (CPE NVD)
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*≤ 2.319.1cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*≤ 2.329cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Jenkins project · Jenkins | affected unspecified ≤ 2.329 ; affected unspecified ≤ LTS 2.319.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |