{"vulnerability": "cve-2022-36920", "sightings": [{"uuid": "0076c2d4-a0ec-43f3-ab7b-5bed39c56720", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36920", "type": "seen", "source": "https://t.me/cibsecurity/47104", "content": "\u203c CVE-2022-36920 \u203c\n\nA cross-site request forgery (CSRF) vulnerability in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-07-27T18:50:05.000000Z"}, {"uuid": "7f8b71ae-a829-4d64-be62-0ec2def8a714", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36920", "type": "seen", "source": "https://t.me/hacking_Attack/64178", "content": "Black Hat Ethical Hacking\nJenkins security: Unpatched XSS, CSRF bugs included in latest plugin advisory\n\nJenkins security: Unpatched XSS, CSRF bugs included in latest plugin advisoryPost Views: 65 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Open source DevOps platform Jenkins is warning users of unpatched security vulnerabilities impacting more than a dozen plugins.A leading open source\u00a0automation server, Jenkins provides thousands of plugins to support building, deploying, and automating projects.\n\nThe organization\u2019s latest security advisory\u00a0lists a total of 27 plugin vulnerabilities, five of which were deemed to be \u2018high\u2019 impact and the majority of which remain unpatched.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course High fiveFirst on the list of high impact bugs \u2013 all of which were unfixed at the time of writing \u2013 is a cross-site request forgery\u00a0(CSRF) vulnerability in the Coverity plugin (CVE-2022-36920).\n\nIt was found that the plugin fails to perform a permission check in an HTTP endpoint. In addition, this HTTP endpoint does not require POST requests, opening the door to CSRF attacks.\n\nMeanwhile, an arbitrary file write vulnerability in the CLIF Performance Testing Plugin (CVE-2022-36894) allows attackers with \u2018Overall/Read\u2019 permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.\n\nStored cross-site scripting\u00a0(XSS) flaws were also discovered in the Dynamic Extended Choice Parameter plugin (CVE-2022-36902) and Maven Metadata plugin (CVE-2022-36905), along with a reflected XSS\u00a0vulnerability in the Lucene-Search plugin (CVE-2022-36922).\n\n\u200b\nTrending: The Difference between White-Box and Black-Box Pentesting Trending: Offensive Security Tool: DDoS-Layer7-bheh Getting the word outOf the 27 plugin vulnerabilities listed in the latest Jenkins security advisory, 18 remained unpatched and are effectively zero-days.\n\nDiscussing the team\u2019s decision to disclose these issues to the community in lieu of any fixes, Jenkins security officer Wadeck Follonier told The Daily Swig: \u201cThe main objective of the Jenkins security team is to ensure the Jenkins plugin ecosystem is as secure as possible.\n\n\u201cWith a plugin ecosystem as big as ours, it isn\u2019t a surprise that not every plugin is maintained all the time, and maintainers sometimes cannot be contacted, do not respond, or tell us they\u2019re no longer able to maintain the plugin.\n\n\u201cIn those cases, we analyze the vulnerability in depth, write up a detailed description, and announce it in a security advisory with other, fixed vulnerabilities.\u201d\n\nFollonier added: \u201cWe believe that announcing vulnerabilities without a fix is the best solution for a difficult problem, as it allows administrators to carefully consider their continued use of the affected plugin.\n\n\u201cBesides the Jenkins Advisories\u00a0mailing list and our social channels, we inform administrators about vulnerabilities affecting their Jenkins instance directly on the UI immediately after publishing an advisory, so every Jenkins administrator gets informed about this.\n\n\u201cOur recommendation to Jenkins administrators is to read our security advisories to understand whether they\u2019re impacted,\u201d Follonier said. \u201cA lot of vulnerabilities\u00a0are irrelevant to instances with only a single administrator user that are inaccessible to others, for example.\n\n\u201cOf course, if they are unsure whether they are affected, the safest thing to do is to uninstall the plugin.\u201d\nTrending: GitHub introduces 2FA and quality of life improvements for npm Are u a security researcher[...]", "creation_timestamp": "2026-09-01T20:01:27.318862Z"}, {"uuid": "219834ad-7c5f-4760-aff9-f5c904880e0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36920", "type": "seen", "source": "https://t.me/hacking_Attack/64178", "content": "Black Hat Ethical Hacking\nJenkins security: Unpatched XSS, CSRF bugs included in latest plugin advisory\n\nJenkins security: Unpatched XSS, CSRF bugs included in latest plugin advisoryPost Views: 65 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Open source DevOps platform Jenkins is warning users of unpatched security vulnerabilities impacting more than a dozen plugins.A leading open source\u00a0automation server, Jenkins provides thousands of plugins to support building, deploying, and automating projects.\n\nThe organization\u2019s latest security advisory\u00a0lists a total of 27 plugin vulnerabilities, five of which were deemed to be \u2018high\u2019 impact and the majority of which remain unpatched.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course High fiveFirst on the list of high impact bugs \u2013 all of which were unfixed at the time of writing \u2013 is a cross-site request forgery\u00a0(CSRF) vulnerability in the Coverity plugin (CVE-2022-36920).\n\nIt was found that the plugin fails to perform a permission check in an HTTP endpoint. In addition, this HTTP endpoint does not require POST requests, opening the door to CSRF attacks.\n\nMeanwhile, an arbitrary file write vulnerability in the CLIF Performance Testing Plugin (CVE-2022-36894) allows attackers with \u2018Overall/Read\u2019 permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.\n\nStored cross-site scripting\u00a0(XSS) flaws were also discovered in the Dynamic Extended Choice Parameter plugin (CVE-2022-36902) and Maven Metadata plugin (CVE-2022-36905), along with a reflected XSS\u00a0vulnerability in the Lucene-Search plugin (CVE-2022-36922).\n\n\u200b\nTrending: The Difference between White-Box and Black-Box Pentesting Trending: Offensive Security Tool: DDoS-Layer7-bheh Getting the word outOf the 27 plugin vulnerabilities listed in the latest Jenkins security advisory, 18 remained unpatched and are effectively zero-days.\n\nDiscussing the team\u2019s decision to disclose these issues to the community in lieu of any fixes, Jenkins security officer Wadeck Follonier told The Daily Swig: \u201cThe main objective of the Jenkins security team is to ensure the Jenkins plugin ecosystem is as secure as possible.\n\n\u201cWith a plugin ecosystem as big as ours, it isn\u2019t a surprise that not every plugin is maintained all the time, and maintainers sometimes cannot be contacted, do not respond, or tell us they\u2019re no longer able to maintain the plugin.\n\n\u201cIn those cases, we analyze the vulnerability in depth, write up a detailed description, and announce it in a security advisory with other, fixed vulnerabilities.\u201d\n\nFollonier added: \u201cWe believe that announcing vulnerabilities without a fix is the best solution for a difficult problem, as it allows administrators to carefully consider their continued use of the affected plugin.\n\n\u201cBesides the Jenkins Advisories\u00a0mailing list and our social channels, we inform administrators about vulnerabilities affecting their Jenkins instance directly on the UI immediately after publishing an advisory, so every Jenkins administrator gets informed about this.\n\n\u201cOur recommendation to Jenkins administrators is to read our security advisories to understand whether they\u2019re impacted,\u201d Follonier said. \u201cA lot of vulnerabilities\u00a0are irrelevant to instances with only a single administrator user that are inaccessible to others, for example.\n\n\u201cOf course, if they are unsure whether they are affected, the safest thing to do is to uninstall the plugin.\u201d\nTrending: GitHub introduces 2FA and quality of life improvements for npm Are u a security researcher[...]", "creation_timestamp": "2026-09-02T01:01:42.301429Z"}]}