CVE-2022-41249 - A cross-site request forgery (CSRF) vulnerability in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins

Back Back to CVE browser

HIGH

A cross-site request forgery (CSRF) vulnerability in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins

Published Sep 21, 2022

8.8

HIGH

CVSS 3.1

EPSS 0.46%

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected products

Vendor Jenkins project Product Jenkins SCM HttpClient Plugin Default
unknown
Affected
- ≥ unspecified, ≤ 1.5

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jenkins project	Jenkins SCM HttpClient Plugin	unknown	Affected ≥ unspecified, ≤ 1.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (5)

http://www.openwall.com/lists/oss-security/2022/09/21/5
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6719
Advisory
https://github.com/advisories/GHSA-6cvr-rvpm-9wx4
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41249
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2708
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2022/09/21/5		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6719		Advisory
https://github.com/advisories/GHSA-6cvr-rvpm-9wx4		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41249
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2708		x_refsource_CONFIRMVendor Advisory