Not rated
CVE-2022-36883 A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds…
Description
A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Git Plugin 4.11 | earliest → 4.11.3 | No fix stated |
| Jenkins Git Plugin 4.9 | earliest → < 4.9.3 | 4.9.3 |
References
- www.jenkins.io www.jenkins.io
- [oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Jenkins Git Plugin
The 7 CVEs of Jenkins Git Plugin →
CVE-2022-38663
Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log…
Not rated
CVE-2022-36884
The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the…
Not rated
CVE-2022-36882
A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger…
Not rated
CVE-2022-30947
Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories…
Not rated