CVE-2022-20612

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins	>= unspecified, <= 2.329; >= unspecified, <= LTS 2.319.1

References

http://www.openwall.com/lists/oss-security/2022/01/12/6Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2558Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/12/6Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2558Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory

Timeline

Published: Jan 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-206134.3A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers to use the DNS CVE-2022-206144.3A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DN CVE-2022-206155.4Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resultin CVE-2022-206164.3Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing a CVE-2022-206178.8Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnera CVE-2022-206184.3A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access CVE-2022-206197.1A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers t CVE-2022-20627.5Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.CVE-2022-206204.3Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials ID CVE-2022-206215.5Jenkins Metrics Plugin 4.0.2.8 and earlier stores an access key unencrypted in its global configuration file on the Jenkins controller where CVE-2022-206227.5A vulnerability in IP ingress packet processing of the Cisco Embedded Wireless Controller with Catalyst Access Points Software could allow a CVE-2022-206237.5A vulnerability in the rate limiter for Bidirectional Forwarding Detection (BFD) traffic of Cisco NX-OS Software for Cisco Nexus 9000 Series