cbcvebase.
CVE-2022-41230
published 2022-09-21

CVE-2022-41230: Jenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to…

PriorityP421medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.62%
49.4th percentile
Jenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain names and URLs of Jenkins servers that the plugin is configured to publish builds to, as well as builds pending for publication to those Jenkins servers.

Affected

23 ranges
VendorProductVersion rangeFixed in
jenkinsanchore_container_image_scanner_plugin——
jenkinsapprenda_plugin——
jenkinsbigpanda_notifier_plugin——
jenkinsbmc_ami_common_configuration_plugin——
jenkinsbuild-publisher<= 1.22—
jenkinscons3rt_plugin——
jenkinsdotci_plugin——
jenkinsjenkins_core——
jenkinsjenkins_weekly——
jenkinslack_of_authentication_mechanism_in_dotci_plugin——
jenkinsns-nd_integration_performance_publisher_plugin——
jenkinsrqm_plugin——
jenkinsrundeck_plugin——
jenkinsscm_httpclient_plugin——
jenkinssecurity_inspector_plugin——
jenkinssmalltest_plugin——
jenkinsthis_could_create_confusion_in_users_of_the_plugin——
jenkinsurls_of_jenkins_servers_that_the_plugin——
jenkinsview26_test-reporting_plugin——
jenkinswalti_plugin——
jenkinswildfly_deployer_plugin——
jenkinsworksoft_execution_manager_plugin——
jenkins_projectjenkins_build-publisher_pluginunspecified – 1.22—
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.