CVE-2022-36882 Lack of authentication mechanism in Jenkins Git Plugin webhook
Attackers can exploit CSRF to trigger Jenkins builds using malicious Git repositories and commits, potentially leading to code execution or data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-36882?
CVE-2022-36882 is a high-severity vulnerability in Jenkins Git Plugin, published on 27 Jul 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
Weakness: CWE-352
Which versions are affected by CVE-2022-36882?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:git. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:git Maven | All versions | 4.11.4 |
org.jenkins-ci.plugins:git Maven | All versions | 4.11.4 |
Products include Jenkins Git.
How do I fix CVE-2022-36882?
Upgrade org.jenkins-ci.plugins:git to 4.11.4 or later.
Is CVE-2022-36882 being exploited?
There is no known exploitation of CVE-2022-36882 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Git Plugin
- CVE-2022-36883 Lack of authentication mechanism in Jenkins Git Plugin webhook
- CVE-2022-30947 Path traversal in Jenkins Git Mercurial and Repo Plugins
- CVE-2017-1000092 Cross-Site Request Forgery in Jenkins Git Plugin
- CVE-2022-38663 Improper masking of credentials Jenkins in Git Plugin
- CVE-2018-1000182 Server-Side Request Forgery in Jenkins Git Plugin
Sources
Also known as GHSA-8xwj-2wgh-gprh.