CVE-2022-34208: CSRF
A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Other sources
Jenkins Beaker builder Plugin 1.10 and earlier does not perform a permission check in a method implementing form validation.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-34208?
CVE-2022-34208 has a medium severity due to the potential for an attacker to connect to arbitrary URLs.
How do I fix CVE-2022-34208?
To fix CVE-2022-34208, upgrade Jenkins Beaker builder Plugin to version 1.11 or later.
Who is affected by CVE-2022-34208?
CVE-2022-34208 affects users of Jenkins Beaker builder Plugin versions 1.10 and earlier.
What type of attack can CVE-2022-34208 facilitate?
CVE-2022-34208 can facilitate URL redirection attacks by allowing unauthorized connections to attacker-specified URLs.
Does CVE-2022-34208 require user interaction to exploit?
No, CVE-2022-34208 can be exploited by attackers who already have Overall/Read permission without any user interaction.