CVE-2022-46688: Jenkins Sonar Gerrit Plugin Cross-Site Request Forgery
Summary
CVE-2022-46688: Jenkins Sonar Gerrit Plugin vulnerable to Cross-Site Request Forgery. Affects org.jenkins-ci.plugins:sonar-gerrit versions < 378.vf4646d4df087. Fixed in 378.vf4646d4df087. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Sonar Gerrit Plugin is a Maven package that integrates Jenkins, Sonar, and Gerrit for code review and analysis. It allows Jenkins to connect to Gerrit servers using configured credentials. This plugin is widely used in software development pipelines to automate code quality checks and review processes.
Vulnerability Detail
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Jenkins Sonar Gerrit Plugin version 377.v8f3808963dc5 and earlier. This vulnerability enables attackers to exploit Jenkins by connecting it to Gerrit servers using attacker-specified credentials IDs obtained through another method. By doing so, attackers can potentially capture credentials stored in Jenkins, compromising the security of the system.
How To Fix
Latest published version: 474.v8b_9ea_76d7b_a_a_ as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
378.vf4646d4df087
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading the Jenkins Sonar Gerrit Plugin to a secure version.
Conclusion
The Jenkins Sonar Gerrit Plugin is vulnerable to a Cross-Site Request Forgery (CSRF) attack, allowing attackers to connect Jenkins to Gerrit servers using unauthorized credentials. It is crucial to upgrade the plugin to a secure version to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:sonar-gerrit →
FAQ
This vulnerability allows attackers to connect Jenkins to Gerrit servers using unauthorized credentials, potentially compromising the security of the system and exposing sensitive information stored in Jenkins.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins instance is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
At the time of this advisory, there are no known public exploits targeting this specific vulnerability. However, it is crucial to apply the recommended fix as soon as possible to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely. Attackers can send crafted requests to the Jenkins instance, tricking it into connecting to Gerrit servers using unauthorized credentials.
There is no evidence of active exploitation of this vulnerability at the time of this advisory. However, it is always recommended to apply security patches and updates promptly to prevent any potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:sonar-gerrit.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
