Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-41230

Jenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain names and URLs of Jenkins servers that the plugin is configured to publish builds to, as well as builds pending for publication to those Jenkins servers.

Published

2022-09-21T16:15:10.217

Last Modified

2025-05-28T15:15:21.040

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.3 (MEDIUM)

Weaknesses

Type: Primary
CWE-862
Type: Secondary
CWE-862

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	jenkins	build-publisher	≤ 1.22	Yes

References

https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-1994 Vendor Advisory ([email protected])
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-1994 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)