CVE-2022-36883 Lack of authentication mechanism in Jenkins Git Plugin webhook

High 7.5 Published 27 Jul 2022 Updated 3 Aug 2024

Unauthenticated attackers can trigger builds using malicious Git repositories, potentially leading to code execution or security bypass in Jenkins environments.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-36883?

CVE-2022-36883 is a high-severity missing authorization vulnerability in Jenkins Git Plugin, published on 27 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.

Weakness: CWE-862

Which versions are affected by CVE-2022-36883?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:git. It affects 1 product.

Package	Affected	Fixed in
`org.jenkins-ci.plugins:git` Maven	All versions	`4.11.4`
`org.jenkins-ci.plugins:git` Maven	All versions	`4.11.4`

Products include Jenkins Git.

How do I fix CVE-2022-36883?

Upgrade org.jenkins-ci.plugins:git to 4.11.4 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-36883 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-36883 exists.

Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.

Sources

Also known as GHSA-v878-67xw-grw2.