CVE-2022-46688
December 07, 2022
A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers (previously configured by Jenkins administrators) using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.
Affected Packages
org.jenkins-ci.plugins:sonar-gerrit (JAVA):
Affected version(s) >=1.0 <378.vf4646d4df087Fix Suggestion:
Update to version 378.vf4646d4df087org.jenkins-ci.plugins:sonar-gerrit (JAVA):
Affected version(s) >=1.0 <378.vf4646d4df087Fix Suggestion:
Update to version 378.vf4646d4df087Related Resources (4)
Do you need more information?
Contact UsCVSS v4
Base Score:
7.1
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Cross-Site Request Forgery (CSRF)
EPSS
Base Score:
0.13
