CVE-2022-25194: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins autonomiq Plugin 1.15 and earlier allows attackers to connect to an attacker-specified URL server using attacker-specified credentials.
Other sources
Jenkins autonomiq Plugin 1.15 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.
Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25194?
CVE-2022-25194 is classified as a medium severity vulnerability due to its potential impact on Jenkins installations.
How do I fix CVE-2022-25194?
To mitigate CVE-2022-25194, upgrade the Jenkins autonomiq Plugin to version 1.16 or later.
What type of vulnerability is CVE-2022-25194?
CVE-2022-25194 is a cross-site request forgery (CSRF) vulnerability.
Which versions of Jenkins autonomiq Plugin are affected by CVE-2022-25194?
CVE-2022-25194 affects Jenkins autonomiq Plugin versions 1.15 and earlier.
Can CVE-2022-25194 allow unauthorized access?
Yes, CVE-2022-25194 can allow attackers to connect to a malicious URL server using specified credentials.