Jenkins Tuleap Git Branch Source Plugin allows unauthenticated attackers to trigger Tuleap projects whose configured repo matches attacker-specified value

MITTEL 5.3CVE-2022-43421 · GHSA-73v5-w6fg-2m44 · Published 19/10/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-43421 ist eine Schwachstelle (MITTEL (CVSS 5.3)) in org.jenkins-ci.plugins:tuleap-git-branch-source, tuleap git branch source (jenkins).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.88%, höher als bei 59.2% aller Schwachstellen.
Abhilfe: auf 3.2.5 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:tuleap-git-branch-source Maven	`< 3.2.5`	`3.2.5`
tuleap git branch source jenkins	`< 3.2.5`	`3.2.5`

Description

A missing permission check in Jenkins Tuleap Git Branch Source Plugin 3.2.4 and earlier allows unauthenticated attackers to trigger Tuleap projects whose configured repository matches the attacker-specified value. Tuleap Git Branch Source Plugin 3.2.5 requires a token to access the webhook endpoint.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-43421 · ADVISORY
jenkins.io/security/advisory/2022-10-19 · WEB
openwall.com/lists/oss-security/2022/10/19/3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free