CVE-2022-36882 - Vulnerability Details - OpenCVE

A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Jenkins	Git
Redhat	Openshift

Configuration 1 [-]

cpe:2.3:a:jenkins:git:*:*:*:*:*:jenkins:*:*

Package	CPE	Advisory	Released Date
Red Hat OpenShift Container Platform 4.10
jenkins-2-plugins-0:4.10.1675144701-1.el8	cpe:/a:redhat:openshift:4.10::el8	RHSA-2023:0560	2023-02-08T00:00:00Z
Red Hat OpenShift Container Platform 4.8
jenkins-2-plugins-0:4.8.1672842762-1.el8	cpe:/a:redhat:openshift:4.8::el8	RHSA-2023:0017	2023-01-12T00:00:00Z
Red Hat OpenShift Container Platform 4.9
jenkins-2-plugins-0:4.9.1675668922-1.el8	cpe:/a:redhat:openshift:4.9::el8	RHSA-2023:0777	2023-02-23T00:00:00Z

References

Link	Providers
http://www.openwall.com/lists/oss-security/2022/07/27/1
https://nvd.nist.gov/vuln/detail/CVE-2022-36882
https://www.cve.org/CVERecord?id=CVE-2022-36882
https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284

History

No history.

MITRE

Status: PUBLISHED

Assigner: jenkins

Published: 2022-07-27T14:20:59

Updated: 2024-08-03T10:14:29.407Z

Reserved: 2022-07-27T00:00:00

Link: CVE-2022-36882

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-07-27T15:15:08.827

Modified: 2024-11-21T07:13:58.690

Link: CVE-2022-36882

Redhat

Severity : Moderate

Publid Date: 2022-08-03T00:00:00Z

Links: CVE-2022-36882 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "Jenkins Git Plugin", "vendor": "Jenkins project", "versions": [{"lessThanOrEqual": "4.11.3", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"status": "unaffected", "version": "4.9.3"}]}], "descriptions": [{"lang": "en", "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T14:23:55.063Z"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284"}, {"name": "[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "jenkinsci-cert@googlegroups.com", "ID": "CVE-2022-36882", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Jenkins Git Plugin", "version": {"version_data": [{"version_affected": "<=", "version_value": "4.11.3"}, {"version_affected": "!", "version_value": "4.9.3"}]}}]}, "vendor_name": "Jenkins project"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}]}, "references": {"reference_data": [{"name": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284", "refsource": "CONFIRM", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284"}, {"name": "[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T10:14:29.407Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284"}, {"name": "[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"}]}]}, "cveMetadata": {"assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "assignerShortName": "jenkins", "cveId": "CVE-2022-36882", "datePublished": "2022-07-27T14:20:59", "dateReserved": "2022-07-27T00:00:00", "dateUpdated": "2024-08-03T10:14:29.407Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:git:*:*:*:*:*:jenkins:*:*", "matchCriteriaId": "3CFA4D2B-B59E-406D-81B2-D1E91B0DABB9", "versionEndIncluding": "4.11.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit."}, {"lang": "es", "value": "Una vulnerabilidad de tipo cross-site request forgery (CSRF) en Jenkins Git Plugin versiones 4.11.3 y anteriores, permite a atacantes desencadenar construcciones de trabajos configurados para usar un repositorio Git especificado por el atacante y causar que comprueben un commit especificado por el atacante"}], "id": "CVE-2022-36882", "lastModified": "2024-11-21T07:13:58.690", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-07-27T15:15:08.827", "references": [{"source": "jenkinsci-cert@googlegroups.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"}, {"source": "jenkinsci-cert@googlegroups.com", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284"}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}