CVE-2022-36884 Lack of authentication mechanism in Jenkins Git Plugin webhook
Unauthenticated attackers can determine if Jenkins jobs use specific Git repositories via the webhook endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-36884?
CVE-2022-36884 is a medium-severity vulnerability in Jenkins Git Plugin, published on 27 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository.
Weakness: CWE-306
Which versions are affected by CVE-2022-36884?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:git. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:git Maven | All versions | 4.11.4 |
org.jenkins-ci.plugins:git Maven | All versions | 4.11.4 |
Products include Jenkins Git.
How do I fix CVE-2022-36884?
Upgrade org.jenkins-ci.plugins:git to 4.11.4 or later.
Is CVE-2022-36884 being exploited?
There is no known exploitation of CVE-2022-36884 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Git Plugin
- CVE-2022-36882 Lack of authentication mechanism in Jenkins Git Plugin webhook
- CVE-2022-36883 Lack of authentication mechanism in Jenkins Git Plugin webhook
- CVE-2022-30947 Path traversal in Jenkins Git Mercurial and Repo Plugins
- CVE-2017-1000092 Cross-Site Request Forgery in Jenkins Git Plugin
- CVE-2022-38663 Improper masking of credentials Jenkins in Git Plugin
Sources
Also known as GHSA-449w-c77c-vmf6.