CVE-2022-28144: Medium severity jenkins vulnerability
Jenkins Proxmox Plugin 0.7.0 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified host using attacker-specified username and password (perform a connection test), disable SSL/TLS validation for the entire Jenkins controller JVM as part of the connection test (see CVE-2022-28142), and test a rollback with attacker-specified parameters.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-28144?
CVE-2022-28144 is considered a critical vulnerability due to its potential to allow unauthorized access and manipulation of connections.
How do I fix CVE-2022-28144?
To fix CVE-2022-28144, upgrade the Jenkins Proxmox Plugin to version 0.7.1 or later.
What versions are vulnerable to CVE-2022-28144?
Jenkins Proxmox Plugin versions 0.7.0 and earlier are vulnerable to CVE-2022-28144.
What type of attacks can CVE-2022-28144 facilitate?
CVE-2022-28144 can facilitate unauthorized connection tests to attacker-specified hosts by exploiting insufficient permission checks.
Who is affected by CVE-2022-28144?
Users of the Jenkins Proxmox Plugin version 0.7.0 or earlier with Overall/Read permission are affected by CVE-2022-28144.