Jenkins Failed Job Deactivator Plugin Missing Authorization vulnerability

MEDIUM 4.3CVE-2022-34818 · GHSA-hcjr-6jq3-392p · Published 30/06/2022 · updated 17/06/2026

In short

CVE-2022-34818 is a MEDIUM (CVSS 4.3) vulnerability affecting de.einsundeins.jenkins.plugins.failedjobdeactivator:failedJobDeactivator, failed job deactivator (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.60%, higher than 48.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
de.einsundeins.jenkins.plugins.failedjobdeactivator:failedJobDeactivator Maven	`≤ 1.2.1`	No fix yet
failed job deactivator jenkins	`≤ 1.2.1`	No fix yet

Description

Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints.

This allows attackers with Overall/Read permission to disable jobs.

Additionally, these endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.

NVD description

Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall/Read permission to disable jobs.

References

nvd.nist.gov/vuln/detail/CVE-2022-34818 · ADVISORY
jenkinsci/failedjobdeactivator-plugin · PACKAGE
jenkins.io/security/advisory/2022-06-30 · WEB

More vulnerabilities in de.einsundeins.jenkins.plugins.failedjobdeactivator:failedJobDeactivator

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In short

CVE-2022-34818 is a MEDIUM (CVSS 4.3) vulnerability affecting de.einsundeins.jenkins.plugins.failedjobdeactivator:failedJobDeactivator, failed job deactivator (jenkins).

Chance of exploitation in the next 30 days (EPSS): 0.60%, higher than 48.8% of all vulnerabilities.

No patched version is listed yet: follow the vendor's advisory in References.

Package

Affected versions

Patched versions

de.einsundeins.jenkins.plugins.failedjobdeactivator:failedJobDeactivator

Maven

≤ 1.2.1

No fix yet

failed job deactivator

jenkins

≤ 1.2.1

No fix yet

Description

Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints.

This allows attackers with Overall/Read permission to disable jobs.

Additionally, these endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.

NVD description

Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall/Read permission to disable jobs.