CVE-2022-20613: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.
Other sources
Jenkins Mailer Plugin prior to 408.vd726a1130320 and 1.34.2 does not perform a permission check in a method implementing form validation.
This allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.
Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Mailer Plugin 408.vd726a1130320 and 1.34.2 require POST requests and Overall/Administer permission for the affected form validation method.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-20613?
CVE-2022-20613 is a cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin.
How does CVE-2022-20613 affect Jenkins Mailer Plugin?
CVE-2022-20613 allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.
What is the severity of CVE-2022-20613?
The severity of CVE-2022-20613 is medium with a CVSS score of 4.3.
How can I fix CVE-2022-20613 in Jenkins Mailer Plugin?
To fix CVE-2022-20613, you should update Jenkins Mailer Plugin to version 408.vd726a or later.
Where can I find more information about CVE-2022-20613?
You can find more information about CVE-2022-20613 at the following references: [1], [2], [3].