VulnerabilityModified
CVE-2022-30969
A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without sandbox protection if the victim is an administrator.
HIGH 8.8EPSS 0.86%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.86%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without sandbox protection if the victim is an administrator.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.86% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- jenkins/autocomplete parameter
- Source
- jenkinsci-cert@googlegroups.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.