CVE-2022-25198: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials.
Other sources
SCP publisher Plugin 1.8 and earlier does not perform a permission check in a method implementing form validation.
This allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials.
Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25198?
CVE-2022-25198 has been rated as a medium severity vulnerability due to its ability to allow unauthorized SSH connections.
How do I fix CVE-2022-25198?
To fix CVE-2022-25198, update the Jenkins SCP publisher Plugin to version 1.9 or later.
What does CVE-2022-25198 affect?
CVE-2022-25198 affects the Jenkins SCP publisher Plugin version 1.8 and earlier.
What is a cross-site request forgery (CSRF) vulnerability in CVE-2022-25198?
In CVE-2022-25198, CSRF allows attackers to execute unintended commands on behalf of a user without their consent.
What are the potential consequences of CVE-2022-25198?
The potential consequences of CVE-2022-25198 include unauthorized access to SSH servers using compromised credentials.