CVE-2022-29048 - Vulnerability Details - OpenCVE

A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00126.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Apple	Macos
Jenkins	Subversion

Configuration 1 [-]

cpe:2.3:a:jenkins:subversion:*:*:*:*:*:jenkins:*:*

Configuration 2 [-]

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
Github GHSA	GHSA-m5cw-c64p-77h6	CSRF vulnerability in Jenkins Subversion Plugin

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://seclists.org/fulldisclosure/2022/Jul/18
https://nvd.nist.gov/vuln/detail/CVE-2022-29048
https://support.apple.com/kb/HT213345
https://www.cve.org/CVERecord?id=CVE-2022-29048
https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2075

History

Wed, 20 Nov 2024 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: jenkins

Published: 2022-04-12T19:50:48

Updated: 2024-11-20T15:28:46.877Z

Reserved: 2022-04-11T00:00:00

Link: CVE-2022-29048

Vulnrichment

Updated: 2024-08-03T06:10:58.450Z

NVD

Status : Modified

Published: 2022-04-12T20:15:09.663

Modified: 2024-11-21T06:58:24.350

Link: CVE-2022-29048

Redhat

Severity : Moderate

Publid Date: 2022-04-12T00:00:00Z

Links: CVE-2022-29048 - Bugzilla

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Jenkins Subversion Plugin", "vendor": "Jenkins project", "versions": [{"lessThanOrEqual": "2.15.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T14:21:33.255Z"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2075"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://support.apple.com/kb/HT213345"}, {"name": "20220721 APPLE-SA-2022-07-20-2 macOS Monterey 12.5", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2022/Jul/18"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "jenkinsci-cert@googlegroups.com", "ID": "CVE-2022-29048", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Jenkins Subversion Plugin", "version": {"version_data": [{"version_affected": "<=", "version_value": "2.15.3"}]}}]}, "vendor_name": "Jenkins project"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}]}, "references": {"reference_data": [{"name": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2075", "refsource": "CONFIRM", "url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2075"}, {"name": "https://support.apple.com/kb/HT213345", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT213345"}, {"name": "20220721 APPLE-SA-2022-07-20-2 macOS Monterey 12.5", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2022/Jul/18"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:10:58.450Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2075"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.apple.com/kb/HT213345"}, {"name": "20220721 APPLE-SA-2022-07-20-2 macOS Monterey 12.5", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2022/Jul/18"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-01-03T16:29:55.539234Z", "id": "CVE-2022-29048", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-20T15:28:46.877Z"}}]}, "cveMetadata": {"assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "assignerShortName": "jenkins", "cveId": "CVE-2022-29048", "datePublished": "2022-04-12T19:50:48", "dateReserved": "2022-04-11T00:00:00", "dateUpdated": "2024-11-20T15:28:46.877Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2075", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://support.apple.com/kb/HT213345", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2022/Jul/18", "name": "20220721 APPLE-SA-2022-07-20-2 macOS Monterey 12.5", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:10:58.450Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-29048", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-01-03T16:29:55.539234Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-20T15:28:41.309Z"}}], "cna": {"affected": [{"vendor": "Jenkins project", "product": "Jenkins Subversion Plugin", "versions": [{"status": "affected", "version": "unspecified", "versionType": "custom", "lessThanOrEqual": "2.15.3"}]}], "references": [{"url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2075", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://support.apple.com/kb/HT213345", "tags": ["x_refsource_CONFIRM"]}, {"url": "http://seclists.org/fulldisclosure/2022/Jul/18", "name": "20220721 APPLE-SA-2022-07-20-2 macOS Monterey 12.5", "tags": ["mailing-list", "x_refsource_FULLDISC"]}], "descriptions": [{"lang": "en", "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T14:21:33.255Z"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "2.15.3", "version_affected": "<="}]}, "product_name": "Jenkins Subversion Plugin"}]}, "vendor_name": "Jenkins project"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2075", "name": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2075", "refsource": "CONFIRM"}, {"url": "https://support.apple.com/kb/HT213345", "name": "https://support.apple.com/kb/HT213345", "refsource": "CONFIRM"}, {"url": "http://seclists.org/fulldisclosure/2022/Jul/18", "name": "20220721 APPLE-SA-2022-07-20-2 macOS Monterey 12.5", "refsource": "FULLDISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-29048", "STATE": "PUBLIC", "ASSIGNER": "jenkinsci-cert@googlegroups.com"}}}}, "cveMetadata": {"cveId": "CVE-2022-29048", "state": "PUBLISHED", "dateUpdated": "2024-11-20T15:28:46.877Z", "dateReserved": "2022-04-11T00:00:00", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "datePublished": "2022-04-12T19:50:48", "assignerShortName": "jenkins"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:subversion:*:*:*:*:*:jenkins:*:*", "matchCriteriaId": "FFE39036-B5C9-4E00-BD27-0D090D4958E1", "versionEndIncluding": "2.15.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "BFABC0C7-944C-4B46-A985-8B4F8BF93F54", "versionEndExcluding": "12.5", "versionStartIncluding": "12.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL."}, {"lang": "es", "value": "Una vulnerabilidad de tipo cross-site request forgery (CSRF) en Jenkins Subversion Plugin versiones 2.15.3 y anteriores, permite a atacantes conectarse a una URL especificada por el atacante"}], "id": "CVE-2022-29048", "lastModified": "2024-11-21T06:58:24.350", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-12T20:15:09.663", "references": [{"source": "jenkinsci-cert@googlegroups.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2022/Jul/18"}, {"source": "jenkinsci-cert@googlegroups.com", "tags": ["Third Party Advisory"], "url": "https://support.apple.com/kb/HT213345"}, {"source": "jenkinsci-cert@googlegroups.com", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2075"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2022/Jul/18"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://support.apple.com/kb/HT213345"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2075"}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}