Vulnerability · Published Dec 7, 2022 · Assigned by jenkins
CVE-2022-46688
Medium 6.5
In plain English
A medium-severity cross-site request forgery in Jenkins Sonar Gerrit Plugin from Jenkins Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers (previously configured by Jenkins administrators) using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:sonar-gerrit | 378.vf4646d4df087 | GHSA-m82g-fv7v-h64m |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Jenkins Project | Jenkins Sonar Gerrit Plugin | unspecified – through 377.v8f3808963dc5 |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N