In short
- CVE-2022-36908 is a MEDIUM (CVSS 6.5) vulnerability affecting org.jenkins-ci.plugins:openshift-deployer, openshift deployer (jenkins).
- Chance of exploitation in the next 30 days (EPSS): 0.55%, higher than 46.0% of all vulnerabilities.
- No patched version is listed yet: follow the vendor's advisory in References.
Description
OpenShift Deployer Plugin 1.2.0 and earlier does not perform permission checks in methods implementing form validation.
These form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
NVD description
A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to check for the existence of an attacker-specified file path on the Jenkins controller file system and to upload a SSH key file from the Jenkins controller file system to an attacker-specified URL.
More vulnerabilities in org.jenkins-ci.plugins:openshift-deployer
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free