Lucene search

JenkinsCVE-2022-27214

HistoryMar 15, 2022 - 5:15 p.m.

CVE-2022-27214

2022-03-1517:15:12

CWE-352

jenkins

web.nvd.nist.gov

cve

2022

27214

csrf

vulnerability

jenkins

release helper plugin

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

42.0%

JSON

A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.

Affected configurations

Nvd

Node

jenkinsrelease_helperRange≤1.3.3jenkins

VendorProductVersionCPE
jenkinsrelease_helper*cpe:2.3:a:jenkins:release_helper:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	release_helper	*	cpe:2.3:a:jenkins:release_helper::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins Release Helper Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "1.3.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unknown",
        "version": "next of 1.3.3",
        "versionType": "custom"
      }
    ]
  }
]

References

www.openwall.com/lists/oss-security/2022/03/15/2

www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2274

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

42.0%

JSON

Related for CVE-2022-27214