1. Home
  2. Vulnerabilities
  3. CVE-2022-43408

CVE-2022-43408

CVSS v3.1 6.5 (Medium)
65% Progress
EPSS 0.08 % (36th)
0.08% Progress
Affected Products 1
Advisories 2
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software Tools, Exploits & PoC Graph Web & Social Timeline

Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proceed or abort Pipeline builds, allowing attackers able to configure Pipelines to specify 'input' step IDs resulting in URLs that would bypass the CSRF protection of any target URL in Jenkins.

Weaknesses
CWE-352
Cross-Site Request Forgery (CSRF)
CVE Status
PUBLISHED
CNA
Jenkins Project
Published Date
2022-10-19 16:15:10
(23 months ago)
Updated Date
2023-11-01 20:54:03
(10 months ago)

Affected Products

Jenkins

Configuration #1

    CPE23 From Up To
  Jenkins Pipeline:stage View for Jenkins prior 2.27 version cpe:2.3:a:jenkins:pipeline\:stage_view::*:*:*:*:jenkins < 2.27