CVE-2022-30958

2022-05-1715:15:10

Google

osv.dev

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.3%

JSON

A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CPENameOperatorVersion
ssh-plugineqssh-2.2
ssh-plugineqssh-2.1
ssh-plugineqssh-1.3
ssh-plugineqssh-2.6
ssh-plugineqssh-2.5
ssh-plugineqssh-1.6
ssh-plugineqssh-1.7
ssh-plugineqssh-1.5
ssh-plugineqssh-2.4
ssh-plugineqssh-2.6.1

Name	Operator	Version
ssh-plugin	eq	ssh-2.2
ssh-plugin	eq	ssh-2.1
ssh-plugin	eq	ssh-1.3
ssh-plugin	eq	ssh-2.6
ssh-plugin	eq	ssh-2.5
ssh-plugin	eq	ssh-1.6
ssh-plugin	eq	ssh-1.7
ssh-plugin	eq	ssh-1.5
ssh-plugin	eq	ssh-2.4
ssh-plugin	eq	ssh-2.6.1