CVE-2022-30969: Cross-Site Request Forgery in Jenkins Autocomplete Parameter Plugin
Summary
CVE-2022-30969: Cross-Site Request Forgery in Jenkins Autocomplete Parameter Plugin. Affects org.jenkins-ci.plugins:autocomplete-parameter versions < 1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Autocomplete Parameter Plugin is a Maven package (org.jenkins-ci.plugins:autocomplete-parameter) that provides functionality for autocompleting parameter values in Jenkins. It allows administrators to define parameters with autocomplete options, enhancing the user experience. However, versions 1.1 and earlier of this plugin are vulnerable to a cross-site request forgery (CSRF) attack.
Vulnerability Detail
The vulnerability (CVE-2022-30969) in the Jenkins Autocomplete Parameter Plugin allows attackers to execute arbitrary code without sandbox protection if the victim is an administrator. This CSRF vulnerability can be exploited by tricking an administrator into performing unintended actions without their consent or knowledge. The impact of this vulnerability is significant, as it enables unauthorized code execution and potential compromise of the Jenkins instance.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the Jenkins Autocomplete Parameter Plugin to the latest secure version.
Conclusion
The Jenkins Autocomplete Parameter Plugin versions 1.1 and earlier are vulnerable to a CSRF attack, allowing attackers to execute arbitrary code without sandbox protection. To mitigate this vulnerability, it is crucial to upgrade the plugin to version 1.2 or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:autocomplete-parameter →
FAQ
The vulnerability allows attackers to execute arbitrary code without sandbox protection if the victim is an administrator. This can lead to unauthorized code execution and potential compromise of the Jenkins instance.
Users of Jenkins Autocomplete Parameter Plugin versions 1.1 and earlier are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to update the plugin to the latest secure version.
To fix this vulnerability, upgrade the Jenkins Autocomplete Parameter Plugin to version 1.2 or later.
You can find more information about this vulnerability in the GitHub Advisory Database: [link to the vulnerability details].
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:autocomplete-parameter.
