CVE-2022-20614

A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.

Published: Jan 12, 2022
Updated: May 9, 2024
CVE: CVE-2022-20614
GHSA: GHSA-558x-h7rg-997v
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 4.3
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CVSS v2:

Severity: Low
Score: 4
AV:N/AC:L/Au:S/C:N/I:P/A:N

CWEs:

CWE-732
CWE-862

Affected Software
References

Software	From	Fixed in
jenkins / mailer	391.ve4a_38c1b_cf4b_	391.ve4a_38c1b_cf4b_.x
jenkins / mailer	-	1.34.2
oracle / communications_cloud_native_core_automated_test_suite	1.9.0	1.9.0.x
org.jenkins-ci.plugins / mailer	-	408.vd726a_1130320

http://www.openwall.com/lists/oss-security/2022/01/12/6
https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2163
https://www.oracle.com/security-alerts/cpuapr2022.html

Vulnerability Database

CVE-2022-20614

Deep Security Visibility Without the Complexity