CVE-2022-43407

Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is used for the URLs that process user interactions for the given 'input' step (proceed or abort) and is not correctly encoded, allowing attackers able to configure Pipelines to have Jenkins build URLs from 'input' step IDs that would bypass the CSRF protection of any target URL in Jenkins when the 'input' step is interacted with.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://www.openwall.com/lists/oss-security/2022/10/19/3	Mailing List Third Party Advisory
https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2880	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jenkins:pipeline\:_input_step:*:*:*:*:*:jenkins:*:*

History

21 Oct 2022, 17:40

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8
CPE		cpe:2.3:a:jenkins:input_step::::::jenkins::*
References	~~(CONFIRM) https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2880 -~~	(CONFIRM) https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2880 - Vendor Advisory
References	~~(MLIST) http://www.openwall.com/lists/oss-security/2022/10/19/3 -~~	(MLIST) http://www.openwall.com/lists/oss-security/2022/10/19/3 - Mailing List, Third Party Advisory

19 Oct 2022, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-10-19 16:15

Updated : 2024-02-04 22:51

NVD link : CVE-2022-43407

Mitre link : CVE-2022-43407

CVE.ORG link : CVE-2022-43407

JSON object : View

Products Affected

jenkins

pipeline\

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2022-43407", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-10-19T16:15:10.483", "references": [{"url": "http://www.openwall.com/lists/oss-security/2022/10/19/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "jenkinsci-cert@googlegroups.com"}, {"url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2880", "tags": ["Vendor Advisory"], "source": "jenkinsci-cert@googlegroups.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is used for the URLs that process user interactions for the given 'input' step (proceed or abort) and is not correctly encoded, allowing attackers able to configure Pipelines to have Jenkins build URLs from 'input' step IDs that would bypass the CSRF protection of any target URL in Jenkins when the 'input' step is interacted with."}, {"lang": "es", "value": "Jenkins Pipeline: Input Step Plugin versiones 451.vf1a_a_4f405289 y anteriores, no restringe o sanea el ID opcionalmente especificado del paso \"input\", que es usado para las URLs que procesan las interacciones del usuario para el paso 'input' dado (proceder o abortar) y no est\u00e1 correctamente codificado, permitiendo a atacantes capaces de configurar Pipelines para que Jenkins construya URLs a partir de IDs de pasos 'input' que podr\u00edan omitir la protecci\u00f3n CSRF de cualquier URL de destino en Jenkins cuando se interact\u00faa con el paso 'input'"}], "lastModified": "2023-11-01T20:53:02.037", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:pipeline\\:_input_step:*:*:*:*:*:jenkins:*:*", "vulnerable": true, "matchCriteriaId": "B97162AA-B2F5-4395-9679-26E780589BC5", "versionEndIncluding": "451.vf1a_a_4f405289"}], "operator": "OR"}]}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com"}