GHSA-j896-j72w-cr32

Source

https://github.com/advisories/GHSA-j896-j72w-cr32

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-j896-j72w-cr32/GHSA-j896-j72w-cr32.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-j896-j72w-cr32

Aliases

CVE-2022-36887

Published

2022-07-28T00:00:43Z

Modified

2024-02-16T08:19:53.977426Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Jenkins Job Configuration History Plugin does not require POST requests for several HTTP endpoints

Details

Jenkins Job Configuration History Plugin 1155.v28a46acc06a_5 and earlier does not require POST requests for several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities.

These vulnerabilities allow attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations.

Job Configuration History Plugin 1156.v536a97b8d649 requires POST requests for the affected HTTP endpoints.

Database specific

{
    "nvd_published_at": "2022-07-27T15:15:00Z",
    "cwe_ids": [
        "CWE-352"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-08-11T15:15:31Z"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:jobConfigHistory

Package

Name: org.jenkins-ci.plugins:jobConfigHistory; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/jobConfigHistory

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1156.v536a_97b_8d649

Affected versions

1.*

1.10

1.11

1.12

1.13

2.*

2.0

2.1

2.1.1

2.2

2.3

2.4

2.5

2.6

2.8

2.9

2.10

2.11

2.12

2.13

2.14

2.15

2.16

2.17

2.18

2.18.1

2.18.2

2.18.3

2.19

2.20

2.21

2.22

2.23

2.23.1

2.24

2.25

2.26

2.27

2.28

2.28.1

2.29-rc1073.41ef89cf4e15

2.29

2.30

2.31-rc1092.de9e11acbcf3

2.31-rc1098.b666422863b2

2.31-rc1107.2354f08725a_8

2.31-rc1118.fdcd7d8898ff

1119.*

1119.v509e1017356b_

1133.*

1133.v0f5420f85053

1139.*

1139.v888b_656ca_f6d

1146.*

1146.v94c2521f9213

1148.*

1148.v8607da_ef251e

1155.*

1155.v28a_46a_cc06a_5

Database specific

{
    "last_known_affected_version_range": "<= 1155.v28a"
}