CVE-2022-28143: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins Proxmox Plugin 0.7.0 and earlier allows attackers to connect to an attacker-specified host using attacker-specified username and password (perform a connection test), disable SSL/TLS validation for the entire Jenkins controller JVM as part of the connection test (see CVE-2022-28142), and test a rollback with attacker-specified parameters.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-28143?
CVE-2022-28143 is classified as a critical severity vulnerability due to its potential for misuse via cross-site request forgery.
How do I fix CVE-2022-28143?
To mitigate CVE-2022-28143, upgrade the Jenkins Proxmox Plugin to version 0.7.1 or later.
What type of vulnerability is CVE-2022-28143?
CVE-2022-28143 is a cross-site request forgery (CSRF) vulnerability.
Which versions of the Jenkins Proxmox Plugin are affected by CVE-2022-28143?
Jenkins Proxmox Plugin versions 0.7.0 and earlier are affected by CVE-2022-28143.
What potential impact does CVE-2022-28143 have on Jenkins?
CVE-2022-28143 may allow attackers to connect to an attacker-specified host and disable SSL/TLS validation.