CVE-2022-30946

A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver.

Published: May 17, 2022
Updated: May 9, 2024
CVE: CVE-2022-30946
GHSA: GHSA-qwgx-mrv5-87j8
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 4.3
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

CWE-352

Affected Software
References

Software	From	Fixed in
jenkins / script_security	-	1172.v35f6a_0b_8207e
org.jenkins-ci.plugins / script-security	-	1172.v35f6a

http://www.openwall.com/lists/oss-security/2022/05/17/8
https://github.com/jenkinsci/script-security-plugin/commit/35f6a0b8207ed3a32a85f27c1312da6cd738eeaa
https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116

Vulnerability Database

CVE-2022-30946

Deep Security Visibility Without the Complexity