Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proceed or abort Pipeline builds, allowing attackers able to configure Pipelines to specify 'input' step IDs resulting in URLs that would bypass the CSRF protection of any target URL in Jenkins.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2022/10/19/3 | Mailing List Third Party Advisory |
| https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2828 | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2022/10/19/3 | Mailing List Third Party Advisory |
| https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2828 | Vendor Advisory |
Configurations
History
21 Nov 2024, 07:26
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2022/10/19/3 - Mailing List, Third Party Advisory | |
| References | () https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2828 - Vendor Advisory |
21 Oct 2022, 18:52
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | (CONFIRM) https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2828 - Vendor Advisory | |
| References | (MLIST) http://www.openwall.com/lists/oss-security/2022/10/19/3 - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:a:jenkins:stage_view:*:*:*:*:*:jenkins:*:* |
19 Oct 2022, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-10-19 16:15
Updated : 2024-11-21 07:26
NVD link : CVE-2022-43408
Mitre link : CVE-2022-43408
CVE.ORG link : CVE-2022-43408
JSON object : View
Products Affected
jenkins
- pipeline\
CWE
CWE-352
Cross-Site Request Forgery (CSRF)