CVE-2022-20614: CSRF
A missing permission check in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.
Other sources
Jenkins Mailer Plugin prior to 408.vd726a1130320 and 1.34.2 does not perform a permission check in a method implementing form validation.
This allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.
Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Mailer Plugin 408.vd726a1130320 and 1.34.2 requires POST requests and Overall/Administer permission for the affected form validation method.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this Jenkins Mailer Plugin vulnerability?
The vulnerability ID for this Jenkins Mailer Plugin vulnerability is CVE-2022-20614.
What is the severity rating of CVE-2022-20614?
CVE-2022-20614 has a severity rating of medium (4.3).
How does the Jenkins Mailer Plugin vulnerability (CVE-2022-20614) work?
The Jenkins Mailer Plugin vulnerability (CVE-2022-20614) allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.
Which versions of Jenkins Mailer Plugin are affected by CVE-2022-20614?
Jenkins Mailer Plugin versions 391.ve4a_38c1b_cf4b_ and earlier, as well as version 1.34.2, are affected by CVE-2022-20614.
How can I fix the Jenkins Mailer Plugin vulnerability (CVE-2022-20614)?
To fix the Jenkins Mailer Plugin vulnerability (CVE-2022-20614), upgrade to version 408.vd726a_1130320 or later.