6.5 Medium

CVE-2022-46688 A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows…

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers (previously configured by Jenkins administrators) using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins Sonar Gerrit Plugin 377	earliest → 377.v8f3808963dc5	No fix stated

The 2 CVEs of Jenkins Sonar Gerrit Plugin →

CVE-2019-10467 Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they… Not rated

Do you use Jenkins Sonar Gerrit Plugin?

Track this CVE Watch Jenkins Sonar Gerrit Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2022-46688

Timeline

Published December 7, 2022
Last modified April 23, 2025

References

www.jenkins.io www.jenkins.io

Track this CVE

CVE-2022-46688 A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows…

Description

Affected products and versions

Other CVEs of Jenkins Sonar Gerrit Plugin