CVE-2022-34812

CWE-352 — Cross-Site Request Forgery (CSRF)5 documents5 sources

Severity

4.3MEDIUM

EPSS

0.1%

top 75.58%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Jenkins Project Jenkins Xpath Configuration Viewer Plugin Jenkins Xpath Configuration Viewer

Timeline

PublishedJun 30

Latest updateJul 1

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath expressions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5jenkins_project/jenkins_xpath_configuration_viewer_pluginunspecified — 1.1.1

▶NVDjenkins/xpath_configuration_viewer1.1.1

▶Mavenorg.jenkins-ci.plugins:xpath-config-viewer1.1.1

🔴Vulnerability Details

OSV

Cross-Site Request Forgery in Jenkins XPath Configuration Viewer Plugin↗2022-07-01

▶

GHSA

Cross-Site Request Forgery in Jenkins XPath Configuration Viewer Plugin↗2022-07-01

▶

CVEList

CVE-2022-34812: A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1↗2022-06-30

▶

📋Vendor Advisories

Jenkins

Jenkins Security Advisory 2022-06-30↗2022-06-30

▶