Lucene search

[email protected]CVE-2022-34212

HistoryJun 23, 2022 - 5:15 p.m.

CVE-2022-34212

2022-06-2317:15:18

CWE-862

[email protected]

web.nvd.nist.gov

cve-2022-34212

jenkins

vrealize orchestrator plugin

security vulnerability

permission check

http post

nvd

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.0%

JSON

A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request to an attacker-specified URL.

Affected configurations

NVD

Node

jenkinsvrealize_orchestratorRange≤3.0jenkins

CPENameOperatorVersion
jenkins:vrealize_orchestratorjenkins vrealize orchestratorle3.0

CPE	Name	Operator	Version
jenkins:vrealize_orchestrator	jenkins vrealize orchestrator	le	3.0

CNA Affected

[
  {
    "product": "Jenkins vRealize Orchestrator Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "3.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unknown",
        "version": "next of 3.0",
        "versionType": "custom"
      }
    ]
  }
]