GHSA-j896-j72w-cr32

    Dashboard / Vulnerabilities / GHSA-j896-j72w-cr32

    GHSA-j896-j72w-cr32

    Published: 28 Jul 2022Last Modified: 16 Feb 2024

    Summary: Jenkins Job Configuration History Plugin does not require POST requests for several HTTP endpoints

    Details: Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier does not require POST requests for several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations. Job Configuration History Plugin 1156.v536a_97b_8d649 requires POST requests for the affected HTTP endpoints.

    References: https://nvd.nist.gov/vuln/detail/CVE-2022-36887, https://github.com/jenkinsci/job-config-history-plugin/commit/536a97b8d649b3114f5db24ea32a7c63188a35c6, https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2766, http://www.openwall.com/lists/oss-security/2022/07/27/1

    Affected packages

    Package

    Name: org.jenkins-ci.plugins:jobConfigHistory

    Purl: pkg:maven/org.jenkins-ci.plugins/jobConfigHistory

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1156.v536a_97b_8d649

    Affected versions

    1.10

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-j896-j72w-cr32 | CVE-DB