CVE-2022-34817: Cross-Site Request Forgery in Jenkins Failed Job Deactivator Plugin
Summary
CVE-2022-34817: Cross-Site Request Forgery in Jenkins Failed Job Deactivator Plugin. Affects de.einsundeins.jenkins.plugins.failedjobdeactivator:failedJobDeactivator versions < 1.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Failed Job Deactivator Plugin is a Maven package that provides functionality to disable failed jobs in Jenkins. It is commonly used in Jenkins installations to automatically deactivate jobs that have failed multiple times. This plugin helps in managing job stability and reducing unnecessary build failures.
Vulnerability Detail
A cross-site request forgery (CSRF) vulnerability has been discovered in Jenkins Failed Job Deactivator Plugin version 1.2.1 and earlier. This vulnerability allows attackers to disable jobs in affected Jenkins installations. The vulnerability is only exploitable in Jenkins versions 2.286 and earlier, as well as LTS versions 2.277.1 and earlier. It is important to note that this vulnerability can have serious consequences, as it allows unauthorized individuals to manipulate job statuses and potentially disrupt the build process.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading Jenkins to the patched versions mentioned above.
Conclusion
The Cross-Site Request Forgery vulnerability in Jenkins Failed Job Deactivator Plugin can have significant consequences, allowing attackers to disable jobs and potentially disrupt the build process. It is crucial to upgrade Jenkins to the recommended versions to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for de.einsundeins.jenkins.plugins.failedjobdeactivator:failedJobDeactivator →
FAQ
This vulnerability allows attackers to disable jobs in Jenkins, potentially disrupting the build process and impacting the stability of the system.
The vulnerability is exploitable in Jenkins versions 2.286 and earlier, as well as LTS versions 2.277.1 and earlier.
No, there is no known workaround. It is essential to upgrade Jenkins to the patched versions to mitigate the vulnerability.
It is recommended to review and update all plugins and dependencies in the Jenkins installation to ensure overall security.
You can find more information about the LTS upgrade guide on the Jenkins website: https://www.jenkins.io/doc/upgrade-guide/2.277/#upgrading-to-jenkins-lts-2-277-2
Related vulnerabilities
Recent vulnerabilities recorded for de.einsundeins.jenkins.plugins.failedjobdeactivator:failedJobDeactivator.
