CVE-2022-36887: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a46acc06a5 and earlier allows attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations.
Other sources
Jenkins Job Configuration History Plugin 1155.v28a46acc06a5 and earlier does not require POST requests for several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities.
These vulnerabilities allow attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations.
Job Configuration History Plugin 1156.v536a97b8d649 requires POST requests for the affected HTTP endpoints.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-36887?
CVE-2022-36887 is a cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier.
How does CVE-2022-36887 affect Jenkins Job Configuration History Plugin?
CVE-2022-36887 allows attackers to perform cross-site request forgery (CSRF) attacks in Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier.
What is the severity of CVE-2022-36887?
CVE-2022-36887 has a severity level of 4.3 (medium).
How can I fix CVE-2022-36887 in Jenkins Job Configuration History Plugin?
To fix CVE-2022-36887, you should update Jenkins Job Configuration History Plugin to version 1156.v536a_97b_8d649 or later.
Where can I find more information about CVE-2022-36887?
You can find more information about CVE-2022-36887 at the following links: [Openwall](http://www.openwall.com/lists/oss-security/2022/07/27/1), [Jenkins Security Advisory](https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2766), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-36887).