GHSA-p92q-7fhh-mq35

Cross-Site Request Forgery in Jenkins

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-20612

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.main:jenkins-core	>= 2.320, < 2.330	2.330
Maven	org.jenkins-ci.main:jenkins-core	< 2.319.2	2.319.2

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins 2.329 and earlier, LTS 2.319.1 and earlier does not require POST requests for the HTTP endpoint handling manual build requests when no security realm is set, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to trigger build of job without parameters. Jenkins 2.330, LTS 2.319.2 requires POST requests for the affected HTTP endpoint.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-20612 advisory
https://github.com/jenkinsci/jenkins/commit/b5c3764681f3b4ce83d0e78f6a9327925640d57e web
https://github.com/jenkinsci/jenkins package
https://www.jenkins.io/changelog-stable/#v2.319.2 web
https://www.jenkins.io/changelog/#v2.330 web
https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2558 web
https://www.oracle.com/security-alerts/cpuapr2022.html web
http://www.openwall.com/lists/oss-security/2022/01/12/6 web