CVE-2022-25208

2022-02-1517:15:11

Google

osv.dev

8.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.8%

JSON

A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response.

CPENameOperatorVersion
sinatra-chef-builder-plugineqsinatra-chef-builder-1.14
sinatra-chef-builder-plugineqsinatra-chef-builder-1.6
sinatra-chef-builder-plugineqsinatra-chef-builder-1.17
sinatra-chef-builder-plugineqsinatra-chef-builder-1.10
sinatra-chef-builder-plugineqsinatra-chef-builder-1.18
sinatra-chef-builder-plugineqsinatra-chef-builder-1.5
sinatra-chef-builder-plugineqsinatra-chef-builder-1.2
sinatra-chef-builder-plugineqsinatra-chef-builder-1.12
sinatra-chef-builder-plugineqsinatra-chef-builder-1.11
sinatra-chef-builder-plugineqsinatra-chef-builder-1.15

Name	Operator	Version
sinatra-chef-builder-plugin	eq	sinatra-chef-builder-1.14
sinatra-chef-builder-plugin	eq	sinatra-chef-builder-1.6
sinatra-chef-builder-plugin	eq	sinatra-chef-builder-1.17
sinatra-chef-builder-plugin	eq	sinatra-chef-builder-1.10
sinatra-chef-builder-plugin	eq	sinatra-chef-builder-1.18
sinatra-chef-builder-plugin	eq	sinatra-chef-builder-1.5
sinatra-chef-builder-plugin	eq	sinatra-chef-builder-1.2
sinatra-chef-builder-plugin	eq	sinatra-chef-builder-1.12
sinatra-chef-builder-plugin	eq	sinatra-chef-builder-1.11
sinatra-chef-builder-plugin	eq	sinatra-chef-builder-1.15