CVE-2022-41234
published 2022-09-21CVE-2022-41234: Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to…
high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to trigger jobs that are configured to be triggerable via Rundeck.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | anchore_container_image_scanner_plugin | — | — |
| jenkins | apprenda_plugin | — | — |
| jenkins | bigpanda_notifier_plugin | — | — |
| jenkins | bmc_ami_common_configuration_plugin | — | — |
| jenkins | cons3rt_plugin | — | — |
| jenkins | dotci_plugin | — | — |
| jenkins | jenkins_core | — | — |
| jenkins | jenkins_weekly | — | — |
| jenkins | lack_of_authentication_mechanism_in_dotci_plugin | — | — |
| jenkins | ns-nd_integration_performance_publisher_plugin | — | — |
| jenkins | rqm_plugin | — | — |
| jenkins | rundeck | <= 3.6.11 | — |
| jenkins | rundeck_plugin | — | — |
| jenkins | scm_httpclient_plugin | — | — |
| jenkins | security_inspector_plugin | — | — |
| jenkins | smalltest_plugin | — | — |
| jenkins | this_could_create_confusion_in_users_of_the_plugin | — | — |
| jenkins | urls_of_jenkins_servers_that_the_plugin | — | — |
| jenkins | view26_test-reporting_plugin | — | — |
| jenkins | walti_plugin | — | — |
| jenkins | wildfly_deployer_plugin | — | — |
| jenkins | worksoft_execution_manager_plugin | — | — |
| jenkins_project | jenkins_rundeck_plugin | unspecified – 3.6.11 | — |