CVE-2022-27198: CSRF
First published: Tue Mar 15 2022(Updated: )
A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <=189.v3551d5642995 | ||
| >=1.28<1.28.2 | ||
| =1.32 | ||
| maven/org.jenkins-ci.plugins:aws-credentials | <=189.v3551d5642995 | |
| Jenkins Cloudbees Aws Credentials | <=189.v3551d5642995 | |
| Jenkins Cloudbees Aws Credentials | >=1.28<1.28.2 | |
| Jenkins Cloudbees Aws Credentials | =1.32 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2022/03/15/2
- https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2351
- https://nvd.nist.gov/vuln/detail/CVE-2022-27198
- https://github.com/jenkinsci/aws-credentials-plugin/commit/cbf183ce58b955f17d93fdc1ac4d19a8ebe693db
- https://github.com/advisories/GHSA-pv4m-7c68-f4c5 (Advisory)
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-pv4m-7c68-f4c5
- alias/CVE-2022-27198
- collector/github-advisory
- collector/nvd-cve
- collector/nvd-api
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/tags
- agent/source
- vendor/jenkins
- package-manager/maven
- canonical/jenkins cloudbees aws credentials
- version/jenkins cloudbees aws credentials/189.v3551d5642995
- version/jenkins cloudbees aws credentials/1.28
- version/jenkins cloudbees aws credentials/1.32