CVE-2022-34206: CSRF
A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to an attacker-specified URL.
Other sources
Jenkins Jianliao Notification Plugin 1.1 and earlier does not perform a permission check in a method implementing form validation.
This allows attackers with Overall/Read permission to send HTTP POST requests to an attacker-specified URL.
Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-34206?
CVE-2022-34206 has a medium severity level due to the potential for attackers to send unauthorized HTTP POST requests.
How do I fix CVE-2022-34206?
To fix CVE-2022-34206, update the Jenkins Jianliao Notification Plugin to version 1.2 or later.
Who is affected by CVE-2022-34206?
Users of Jenkins Jianliao Notification Plugin version 1.1 and earlier are affected by CVE-2022-34206.
What type of attack does CVE-2022-34206 facilitate?
CVE-2022-34206 facilitates unauthorized HTTP POST requests to an attacker-specified URL.
What permissions are required to exploit CVE-2022-34206?
An attacker needs Overall/Read permission to exploit CVE-2022-34206.