CVE-2022-43408: CSRF
A Cross-site request forgery (CSRF) vulnerability was found in a Jenkins plugin. This issue may allow an authenticated attacker to access Jenkins builds, bypassing CSRF protections.
Other sources
Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proceed or abort Pipeline builds, allowing attackers able to configure Pipelines to specify 'input' step IDs resulting in URLs that would bypass the CSRF protection of any target URL in Jenkins.
Jenkins Pipeline: Stage View Plugin provides a visualization of Pipeline builds. It also allows users to interact with input steps from Pipeline: Input Step Plugin.
Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of input steps when using it to generate URLs to proceed or abort Pipeline builds.
This allows attackers able to configure Pipelines to specify input step IDs resulting in URLs that would bypass the CSRF protection of any target URL in Jenkins.
Pipeline: Stage View Plugin 2.27 correctly encodes the ID of input steps when using it to generate URLs to proceed or abort Pipeline builds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 2-plugins-0:4.11.1683009941-1.el8 - Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 2-plugins-0:4.12.1675702407-1.el8 - Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 2-plugins-0:4.10.1675144701-1.el8 - Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 2-plugins-0:4.9.1675668922-1.el8 - Upgrade
Upgrade
maven/org.jenkins-ci.plugins.pipeline-stage-view:pipeline-stage-viewto a version that resolves this vulnerability.Fixed in 2.27 - Upgrade
Upgrade
maven/org.jenkins-ci.plugins.pipeline-stage-view:pipeline-stage-viewto a version that resolves this vulnerability.Fixed in 2.24.2 - Upgrade
Upgrade
redhat/Pipeline Stage View Pluginto a version that resolves this vulnerability.Fixed in 2.27 - Upgrade
Upgrade
Jenkins Pipeline: Stage View Pluginto a version that resolves this vulnerability.Fixed in 2.27 - Compensating control
Apply the Jenkins advisory’s CSRF mitigation for SECURITY-2828 by ensuring attackers cannot reach the proceed/abort URL endpoints (e.g., restrict access to Jenkins/Build URLs to trusted users and networks) until the affected plugin is upgraded to 2.27.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-43408?
CVE-2022-43408 is classified as a medium severity vulnerability due to its potential for unauthenticated access to sensitive builds.
How do I fix CVE-2022-43408?
To fix CVE-2022-43408, upgrade the Jenkins Pipeline: Stage View Plugin to version 2.27 or later.
What versions are affected by CVE-2022-43408?
CVE-2022-43408 affects versions 2.26 and earlier of the Jenkins Pipeline: Stage View Plugin.
Can CVE-2022-43408 be exploited remotely?
CVE-2022-43408 requires an authenticated attacker to exploit the vulnerability.
Is there a patch for CVE-2022-43408?
Yes, a patch is available by updating to Jenkins Pipeline: Stage View Plugin version 2.27 or higher.