GHSA-9mc6-vgmq-x6xf

Lack of authentication mechanism in Jenkins DotCi Plugin webhook

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-41238

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.groupon.jenkins-ci.plugins:DotCi	<= 2.40.00	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

DotCi Plugin provides a webhook endpoint at `/githook/` that can be used to trigger builds of the job for a GitHub repository. In DotCi Plugin 2.40.00 and earlier, this endpoint can be accessed without authentication. This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits. This plugin has been suspended.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-41238 advisory
https://github.com/jenkinsci/DotCi package
https://plugins.jenkins.io/DotCi web
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2867 web
https://www.jenkins.io/security/plugins/#suspensions web