CVE-2022-36882: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
Other sources
A flaw was found in the Git Jenkins plugin. The affected versions of the Git Jenkins Plugin allow attackers to trigger the builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Git Plugin 4.11.3 and earlier, this endpoint can be accessed with GET requests and without authentication.
This webhook endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Git Plugin 4.11.4 requires a token parameter which will act as an authentication for the webhook endpoint. While GET requests remain allowed, attackers would need to be able to provide a webhook token. For more information see the plugin documentation.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-36882?
CVE-2022-36882 is classified as a medium severity vulnerability.
How do I fix CVE-2022-36882?
To fix CVE-2022-36882, upgrade the Jenkins Git Plugin to version 4.11.4 or higher.
What types of attacks does CVE-2022-36882 enable?
CVE-2022-36882 enables attackers to trigger unauthorized builds and check out malicious commits from a specified Git repository.
Which versions of the Jenkins Git Plugin are affected by CVE-2022-36882?
Versions 4.11.3 and earlier of the Jenkins Git Plugin are affected by CVE-2022-36882.
Is CVE-2022-36882 a cross-site request forgery vulnerability?
Yes, CVE-2022-36882 is identified as a cross-site request forgery (CSRF) vulnerability.