CVE-2022-41230

EPSS 0.83%
Published 21.09.2022 16:15:10
Last modified 28.05.2025 15:15:21
Source jenkinsci-cert@googlegroups.co
Teams watchlist Login
Open Login

Jenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain names and URLs of Jenkins servers that the plugin is configured to publish builds to, as well as builds pending for publication to those Jenkins servers.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Jenkins ≫ Build-publisher SwPlatformjenkins Version <= 1.22

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.83%	0.738

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.3	2.8	1.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	4.3	2.8	1.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-1994

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2022-41230

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-41230

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-41230

EUVD