Kurz gesagt
- CVE-2022-36908 ist eine Schwachstelle (MITTEL (CVSS 6.5)) in org.jenkins-ci.plugins:openshift-deployer, openshift deployer (jenkins).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.55%, höher als bei 46.0% aller Schwachstellen.
- Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.
Description
OpenShift Deployer Plugin 1.2.0 and earlier does not perform permission checks in methods implementing form validation.
These form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
NVD description
A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to check for the existence of an attacker-specified file path on the Jenkins controller file system and to upload a SSH key file from the Jenkins controller file system to an attacker-specified URL.
Weitere Schwachstellen in org.jenkins-ci.plugins:openshift-deployer
Alle anzeigen →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free