You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Oct 2, 2023. It is now read-only.
A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
mend-bolt-for-githubbot
changed the title
CVE-2022-36883 (Medium) detected in git-4.2.1.jar
CVE-2022-36883 (High) detected in git-4.2.1.jar
Aug 24, 2022
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
CVE-2022-36883 - High Severity Vulnerability
Vulnerable Library - git-4.2.1.jar
Integrates Jenkins with Git SCM
Library home page: https://github.com/jenkinsci/git-plugin/tree/git-4.2.1/README.adoc
Path to dependency file: /pom.xml
Path to vulnerable library: /-ci/plugins/git/4.2.1/git-4.2.1.jar
Dependency Hierarchy:
Found in HEAD commit: 97ed2b7fe477b78f0b26191e5950825314db7b2c
Found in base branch: master
Vulnerability Details
A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
Publish Date: 2022-07-27
URL: CVE-2022-36883
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284
Release Date: 2022-07-27
Fix Resolution: org.jenkins-ci.plugins:git:4.11.4
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: