VULNERABILITY INTELLIGENCE

CVE-2022-20612

CVSS score4.3 MEDIUM

EPSS probability1.81%

CISA KEVNot currently listed

Published2022-01-12

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.

Weakness classification

nvd@nist.gov: CWE-352

Primary references

jenkinsci-cert@googlegroups.com — Mailing List, Third Party Advisory
jenkinsci-cert@googlegroups.com — Vendor Advisory
jenkinsci-cert@googlegroups.com — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory