CVE-2022-36883
published 2022-07-27CVE-2022-36883: A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an…
PriorityP279high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
7.00%
94.2th percentile
A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | android_signing_plugin | — | — |
| jenkins | bmc_ami_devx_code_debug_code_coverage_plugin | — | — |
| jenkins | bmc_ami_devx_code_pipeline_operations_plugin | — | — |
| jenkins | buckminster_plugin | — | — |
| jenkins | clif_performance_testing_plugin | — | — |
| jenkins | code_pipeline_plugin | — | — |
| jenkins | compuware_topaz_utilities_plugin | — | — |
| jenkins | coverity_plugin | — | — |
| jenkins | deployer_framework_plugin | — | — |
| jenkins | dynamic_extended_choice_parameter_plugin | — | — |
| jenkins | external_monitor_job_type_plugin | — | — |
| jenkins | files_found_trigger_plugin | — | — |
| jenkins | for_more_information_see_the_plugin | — | — |
| jenkins | git | <= 4.11.3 | — |
| jenkins | git_client_plugin | — | — |
| jenkins | git_plugin | — | — |
| jenkins | github_plugin | — | — |
| jenkins | google_cloud_backup_plugin | — | — |
| jenkins | hashicorp_vault_plugin | — | — |
| jenkins | http_request_plugin | — | — |
| jenkins | jenkins_ci_server_plugin | — | — |
| jenkins | job_configuration_history_plugin | — | — |
| jenkins | lack_of_authentication_mechanism_in_git_plugin | — | — |
| jenkins | lucene-search_plugin | — | — |
| jenkins | maven_metadata_plugin | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →HTTP GET request to the /git/notifyCommit endpoint with 'url' and 'branches' parameters — no authentication required — is the attack vector for CVE-2022-36883. ↗
- →A 200 HTTP response containing both 'repository:' and 'SCM API plugin' in the body confirms the endpoint is reachable and vulnerable. ↗
- →Shodan queries for 'X-Jenkins' or 'x-jenkins' response headers can be used to identify exposed Jenkins instances potentially running the vulnerable Git Plugin. ↗
- ·The vulnerability affects Jenkins Git Plugin version 4.11.3 and earlier; upgrade to 4.11.4 or later to remediate. ↗
- ·The nuclei template is tagged 'intrusive' — active probing of /git/notifyCommit will actually trigger builds on vulnerable targets. ↗
- ·Red Hat has marked jenkins-2-plugins for OpenShift Container Platform 3.11 as 'Will not fix', meaning patching may not be available for that package. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
vulncheck7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Lack of authentication mechanism in Jenkins Git Plugin webhook
osv·2022-07-28
CVE-2022-36883 [MEDIUM] Lack of authentication mechanism in Jenkins Git Plugin webhook
Lack of authentication mechanism in Jenkins Git Plugin webhook
Git Plugin provides a webhook endpoint at `/git/notifyCommit` that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Git Plugin 4.11.3 and earlier, this endpoint can be accessed with GET requests and without authentication. In addition to this basic functionality, the endpoint also accept a `sha1` parameter specifying a commit ID. If this parameter is specified, jobs configured with the specified repo will be triggered immediately, and the build will check out the specified commit. Additionally, the output of the webhook endpoint will provide informa
GHSA
Lack of authentication mechanism in Jenkins Git Plugin webhook
ghsa·2022-07-28
CVE-2022-36883 [MEDIUM] CWE-862 Lack of authentication mechanism in Jenkins Git Plugin webhook
Lack of authentication mechanism in Jenkins Git Plugin webhook
Git Plugin provides a webhook endpoint at `/git/notifyCommit` that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Git Plugin 4.11.3 and earlier, this endpoint can be accessed with GET requests and without authentication. In addition to this basic functionality, the endpoint also accept a `sha1` parameter specifying a commit ID. If this parameter is specified, jobs configured with the specified repo will be triggered immediately, and the build will check out the specified commit. Additionally, the output of the webhook endpoint will provide informa
VulnCheck
Jenkins git Missing Authorization
vulncheck·2022·CVSS 7.5
CVE-2022-36883 [HIGH] Jenkins git Missing Authorization
Jenkins git Missing Authorization
A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
Affected: Jenkins git
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.recordedfuture.com/blog/august-2026-cve-landscape
Jenkins
Jenkins Security Advisory 2022-07-27
vendor_jenkins·2022-07-27·CVSS 8.1
CVE-2022-36881 [HIGH] Jenkins Security Advisory 2022-07-27
Title: Jenkins Security Advisory 2022-07-27
Jenkins Security Advisory 2022-07-27
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Android Signing
Plugin
BMC AMI DevX Code Debug Code Coverage
Plugin
BMC AMI DevX Code Pipeline Operations
Plugin
BMC AMI DevX Source Code Download for Endevor, PDS, and Code Pi
Red Hat
plugin: Lack of authentication mechanism in Git Plugin webhook
vendor_redhat·2022-07-27·CVSS 7.5
CVE-2022-36883 [HIGH] CWE-862 plugin: Lack of authentication mechanism in Git Plugin webhook
plugin: Lack of authentication mechanism in Git Plugin webhook
A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
Package: jenkins-2-plugins (Red Hat OpenShift Container Platform 3.11) - Will not fix
No detection rules found.
Nuclei
Jenkins Git <=4.11.3 - Missing Authorization
nuclei·CVSS 7.5
CVE-2022-36883 [HIGH] Jenkins Git <=4.11.3 - Missing Authorization
Jenkins Git =4.11.4) or apply the provided patch to mitigate the vulnerability.
reference:
- https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-36883
- https://nvd.nist.gov/vuln/detail/CVE-2022-36883
- http://www.openwall.com/lists/oss-security/2022/07/27/1
- https://github.com/StarCrossPortal/scalpel
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
cvss-score: 7.5
cve-id: CVE-2022-36883
cwe-id: CWE-862
epss-score: 0.78584
epss-percentile: 0.9904
cpe: cpe:2.3:a:jenkins:git:*:*:*:*:*:jenkins:*:*
metadata:
verified: true
max-request: 1
vendor: jenkins
product: git
framework: jenkins
shodan-query:
- X-Jenkins
- x-jenkins
tags: cve,cve2022,jenkins,plugin,git,intrusive,vuln
http:
- method: GET
path:
No writeups or analysis indexed.
2022-07-27
Published
Exploited in the wild