CVE-2022-34812

published 2022-06-30

CVE-2022-34812: A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath…

Priority P4 17 medium 4.3 CVSS 3.1

AV N AC L PR N UI R S U C N I L A N

A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath expressions.

Affected

25 ranges

Vendor	Product	Version range	Fixed in
jenkins	build_notifications_plugin	—	—
jenkins	cisco_spark_plugin	—	—
jenkins	deployment_dashboard_plugin	—	—
jenkins	elasticsearch_query_plugin	—	—
jenkins	failed_job_deactivator_plugin	—	—
jenkins	feedback_panel_plugin	—	—
jenkins	gitlab_plugin	—	—
jenkins	ids_in_xebialabs_xl_release_plugin	—	—
jenkins	jigomerge_plugin	—	—
jenkins	matrix_reloaded_plugin	—	—
jenkins	opsgenie_plugin	—	—
jenkins	plot_plugin	—	—
jenkins	project_inheritance_plugin	—	—
jenkins	recipe_plugin	—	—
jenkins	request_rename_or_delete_plugin	—	—
jenkins	rich_text_publisher_plugin	—	—
jenkins	rocketchat_notifier_plugin	—	—
jenkins	rqm_plugin	—	—
jenkins	skype_notifier_plugin	—	—
jenkins	testng_results_plugin	—	—
jenkins	validating_email_parameter_plugin	—	—
jenkins	xebialabs_xl_release_plugin	—	—
jenkins	xpath_configuration_viewer	<= 1.1.1	—
jenkins	xpath_configuration_viewer_plugin	—	—
jenkins_project	jenkins_xpath_configuration_viewer_plugin	unspecified – 1.1.1	—

CVSS provenance

nvd v3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-352