CVE-2022-41232

published 2022-09-21

CVE-2022-41232: A cross-site request forgery (CSRF) vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml file on the…

Priority P3 35 high 8 CVSS 3.1

AV N AC L PR L UI R S U C H I H A H

A cross-site request forgery (CSRF) vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml file on the Jenkins controller file system with an empty file by providing a crafted file name to an API endpoint.

Affected

23 ranges

Vendor	Product	Version range	Fixed in
jenkins	anchore_container_image_scanner_plugin	—	—
jenkins	apprenda_plugin	—	—
jenkins	bigpanda_notifier_plugin	—	—
jenkins	bmc_ami_common_configuration_plugin	—	—
jenkins	build-publisher	<= 1.22	—
jenkins	cons3rt_plugin	—	—
jenkins	dotci_plugin	—	—
jenkins	jenkins_core	—	—
jenkins	jenkins_weekly	—	—
jenkins	lack_of_authentication_mechanism_in_dotci_plugin	—	—
jenkins	ns-nd_integration_performance_publisher_plugin	—	—
jenkins	rqm_plugin	—	—
jenkins	rundeck_plugin	—	—
jenkins	scm_httpclient_plugin	—	—
jenkins	security_inspector_plugin	—	—
jenkins	smalltest_plugin	—	—
jenkins	this_could_create_confusion_in_users_of_the_plugin	—	—
jenkins	urls_of_jenkins_servers_that_the_plugin	—	—
jenkins	view26_test-reporting_plugin	—	—
jenkins	walti_plugin	—	—
jenkins	wildfly_deployer_plugin	—	—
jenkins	worksoft_execution_manager_plugin	—	—
jenkins_project	jenkins_build-publisher_plugin	unspecified – 1.22	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-352