CVE-2022-20612: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.
Other sources
Jenkins 2.329 and earlier, LTS 2.319.1 and earlier does not require POST requests for the HTTP endpoint handling manual build requests when no security realm is set, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to trigger build of job without parameters.
Jenkins 2.330, LTS 2.319.2 requires POST requests for the affected HTTP endpoint.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-20612?
CVE-2022-20612 is a cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier LTS 2.319.1 and earlier that allows attackers to trigger a build of a job without proper authorization.
How does CVE-2022-20612 affect Jenkins?
CVE-2022-20612 affects Jenkins 2.329 and earlier LTS 2.319.1 and earlier versions by allowing unauthorized triggering of job builds through a CSRF attack.
What is the severity of CVE-2022-20612?
CVE-2022-20612 has a severity rating of 4.3, which is considered medium.
How can I fix CVE-2022-20612 in Jenkins?
To fix CVE-2022-20612 in Jenkins, you need to upgrade to version 2.330 or later.
Where can I find more information about CVE-2022-20612?
You can find more information about CVE-2022-20612 in the following references: [Openwall](http://www.openwall.com/lists/oss-security/2022/01/12/6), [Jenkins Security Advisory](https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2558), [Oracle Security Advisory](https://www.oracle.com/security-alerts/cpuapr2022.html).