Build-Publisher Plugin up to 1.22 on Jenkins API Endpoint config.xml cross-site request forgery

Summaryinfo

A vulnerability was found in Build-Publisher Plugin up to 1.22 on Jenkins. It has been declared as problematic. Affected is an unknown function of the file config.xml of the component API Endpoint. Executing a manipulation can lead to cross-site request forgery. This vulnerability is tracked as CVE-2022-41232. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in Build-Publisher Plugin up to 1.22 on Jenkins (Jenkins Plugin) and classified as problematic. This vulnerability affects some unknown processing of the file config.xml of the component API Endpoint. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect integrity. CVE summarizes:

A cross-site request forgery (CSRF) vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml file on the Jenkins controller file system with an empty file by providing a crafted file name to an API endpoint.

The weakness was disclosed 09/23/2022. The advisory is available at jenkins.io. This vulnerability was named CVE-2022-41232 since 09/21/2022. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

By approaching the search of inurl:config.xml it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Jenkins Plugin

Name

• Build-Publisher Plugin

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion