Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/98056?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/98056?format=api", "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.8.1672842762-1?arch=el8", "type": "rpm", "namespace": "redhat", "name": "jenkins-2-plugins", "version": "4.8.1672842762-1", "qualifiers": { "arch": "el8" }, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": null, "latest_non_vulnerable_version": null, "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/15957?format=api", "vulnerability_id": "VCID-4qvq-xv22-xbed", "summary": "Missing Authorization\nJenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30954.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30954.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30954", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00184", "scoring_system": "epss", "scoring_elements": "0.40224", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00184", "scoring_system": "epss", "scoring_elements": "0.402", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.41728", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.4174", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.4179", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.418", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.41823", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.41777", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.41826", "published_at": "2026-04-16T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30954" }, { "reference_url": "https://github.com/jenkinsci/blueocean-plugin", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/blueocean-plugin" }, { "reference_url": "https://github.com/jenkinsci/blueocean-plugin/commit/ffd89b675b172c86613459935fe220dc2bba0c57", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/blueocean-plugin/commit/ffd89b675b172c86613459935fe220dc2bba0c57" }, { "reference_url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/05/17/8", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119647", "reference_id": "2119647", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119647" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30954", "reference_id": "CVE-2022-30954", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30954" }, { "reference_url": "https://github.com/advisories/GHSA-5m4q-x28v-q6wp", "reference_id": "GHSA-5m4q-x28v-q6wp", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-5m4q-x28v-q6wp" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0017", "reference_id": "RHSA-2023:0017", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0017" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0560", "reference_id": "RHSA-2023:0560", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0560" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0777", "reference_id": "RHSA-2023:0777", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0777" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3198", "reference_id": "RHSA-2023:3198", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3198" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3610", "reference_id": "RHSA-2023:3610", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3610" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3622", "reference_id": "RHSA-2023:3622", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3622" } ], "fixed_packages": [], "aliases": [ "CVE-2022-30954", "GHSA-5m4q-x28v-q6wp" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4qvq-xv22-xbed" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/55032?format=api", "vulnerability_id": "VCID-7ez2-n617-u3dq", "summary": "Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Jenkins Pipeline: Groovy Plugin\nPipeline: Groovy Plugin allows pipelines to load Groovy source files. This is intended to be used to allow Global Shared Libraries to execute without sandbox protection.\n\nIn Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier, any Groovy source files bundled with Jenkins core and plugins could be loaded this way and their methods executed. If a suitable Groovy source file is available on the classpath of Jenkins, sandbox protections can be bypassed.\n\nThe Jenkins security team has been unable to identify any Groovy source files in Jenkins core or plugins that would allow attackers to execute dangerous code. While the severity of this issue is declared as High due to the potential impact, successful exploitation is considered very unlikely.\n\nPipeline: Groovy Plugin 2692.v76b_089ccd026 restricts which Groovy source files can be loaded in Pipelines.\n\nGroovy source files in public plugins intended to be executed in sandboxed pipelines have been identified and added to an allowlist. The new extension point `org.jenkinsci.plugins.workflow.cps.GroovySourceFileAllowlist` allows plugins to add specific Groovy source files to that allowlist if necessary, but creation of plugin-specific Pipeline DSLs is strongly discouraged.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30945.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30945.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30945", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0111", "scoring_system": "epss", "scoring_elements": "0.78163", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.0111", "scoring_system": "epss", "scoring_elements": "0.78087", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.0111", "scoring_system": "epss", "scoring_elements": "0.78117", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.0111", "scoring_system": "epss", "scoring_elements": "0.781", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.0111", "scoring_system": "epss", "scoring_elements": "0.78126", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.0111", "scoring_system": "epss", "scoring_elements": "0.78132", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.0111", "scoring_system": "epss", "scoring_elements": "0.78158", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.0111", "scoring_system": "epss", "scoring_elements": "0.7814", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.0111", "scoring_system": "epss", "scoring_elements": "0.78136", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.0111", "scoring_system": "epss", "scoring_elements": "0.7817", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.0111", "scoring_system": "epss", "scoring_elements": "0.78169", "published_at": "2026-04-18T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30945" }, { "reference_url": "https://github.com/jenkinsci/workflow-cps-plugin", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/workflow-cps-plugin" }, { "reference_url": "https://github.com/jenkinsci/workflow-cps-plugin/commit/76a7681702f42d65f77bbaa5463f146876ea62db", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/workflow-cps-plugin/commit/76a7681702f42d65f77bbaa5463f146876ea62db" }, { "reference_url": "https://github.com/jenkinsci/workflow-cps-plugin/commit/76b089ccd026b68012b0deb30c217395f7ca7dc2", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/workflow-cps-plugin/commit/76b089ccd026b68012b0deb30c217395f7ca7dc2" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30945", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30945" }, { "reference_url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/05/17/8", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119642", "reference_id": "2119642", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119642" }, { "reference_url": "https://github.com/advisories/GHSA-2xvx-rw9p-xgfc", "reference_id": "GHSA-2xvx-rw9p-xgfc", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-2xvx-rw9p-xgfc" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0017", "reference_id": "RHSA-2023:0017", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "fixed_packages": [], "aliases": [ "CVE-2022-30945", "GHSA-2xvx-rw9p-xgfc" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-7ez2-n617-u3dq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/53867?format=api", "vulnerability_id": "VCID-9h4k-xjx5-afc8", "summary": "Jenkins GitHub plugin uses weak webhook signature function\nJenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature. GitHub Plugin 1.34.5 uses a constant-time comparison when validating the webhook signature.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-36885.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-36885.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-36885", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00338", "scoring_system": "epss", "scoring_elements": "0.56663", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00338", "scoring_system": "epss", "scoring_elements": "0.56636", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00338", "scoring_system": "epss", "scoring_elements": "0.56614", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00338", "scoring_system": "epss", "scoring_elements": "0.56635", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00338", "scoring_system": "epss", "scoring_elements": "0.56613", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00338", "scoring_system": "epss", "scoring_elements": "0.56664", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00338", "scoring_system": "epss", "scoring_elements": "0.5667", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00338", "scoring_system": "epss", "scoring_elements": "0.56678", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00338", "scoring_system": "epss", "scoring_elements": "0.56654", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00338", "scoring_system": "epss", "scoring_elements": "0.56633", "published_at": "2026-04-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-36885" }, { "reference_url": "https://github.com/jenkinsci/github-plugin", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/github-plugin" }, { "reference_url": "https://github.com/jenkinsci/github-plugin/commit/11d1d79ebf85248dc43432389746c1ecc3452b6a", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/github-plugin/commit/11d1d79ebf85248dc43432389746c1ecc3452b6a" }, { "reference_url": "https://github.com/jenkinsci/github-plugin/releases/tag/v1.34.5", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/github-plugin/releases/tag/v1.34.5" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36885", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36885" }, { "reference_url": "https://plugins.jenkins.io/github-issues", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plugins.jenkins.io/github-issues" }, { "reference_url": "https://plugins.jenkins.io/github-issues/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://plugins.jenkins.io/github-issues/" }, { "reference_url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1849", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1849" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/07/27/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119658", "reference_id": "2119658", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119658" }, { "reference_url": "https://github.com/advisories/GHSA-mxcc-7h5m-x57r", "reference_id": "GHSA-mxcc-7h5m-x57r", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-mxcc-7h5m-x57r" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0017", "reference_id": "RHSA-2023:0017", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0017" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0560", "reference_id": "RHSA-2023:0560", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0560" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0777", "reference_id": "RHSA-2023:0777", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "fixed_packages": [], "aliases": [ "CVE-2022-36885", "GHSA-mxcc-7h5m-x57r" ], "risk_score": 2.4, "exploitability": "0.5", "weighted_severity": "4.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9h4k-xjx5-afc8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/58049?format=api", "vulnerability_id": "VCID-c2jh-gx5w-mqcd", "summary": "Path traversal in Jenkins Mercurial Plugin\nSCMs support a number of different URL schemes, including local file system paths (e.g. using file: URLs).\n\nHistorically in Jenkins, only agents checked out from SCM, and if multiple projects share the same agent, there is no expected isolation between builds besides using different workspaces unless overridden. Some Pipeline-related features check out SCMs from the Jenkins controller as well.\n\nThis allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller’s file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30948.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30948.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30948", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01803", "scoring_system": "epss", "scoring_elements": "0.82842", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.01803", "scoring_system": "epss", "scoring_elements": "0.82839", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.01803", "scoring_system": "epss", "scoring_elements": "0.8284", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.01803", "scoring_system": "epss", "scoring_elements": "0.82801", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.01803", "scoring_system": "epss", "scoring_elements": "0.82806", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.01803", "scoring_system": "epss", "scoring_elements": "0.8281", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.01803", "scoring_system": "epss", "scoring_elements": "0.82794", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.01803", "scoring_system": "epss", "scoring_elements": "0.82788", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.01803", "scoring_system": "epss", "scoring_elements": "0.82762", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.02427", "scoring_system": "epss", "scoring_elements": "0.85088", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.02427", "scoring_system": "epss", "scoring_elements": "0.85105", "published_at": "2026-04-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30948" }, { "reference_url": "https://github.com/jenkinsci/mercurial-plugin", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/mercurial-plugin" }, { "reference_url": "https://github.com/jenkinsci/mercurial-plugin/commit/b995436e560b01818f5d9e9920990370cc575341", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/mercurial-plugin/commit/b995436e560b01818f5d9e9920990370cc575341" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30948", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30948" }, { "reference_url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/05/17/8", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119644", "reference_id": "2119644", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119644" }, { "reference_url": "https://github.com/advisories/GHSA-5786-3qjg-mr88", "reference_id": "GHSA-5786-3qjg-mr88", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-5786-3qjg-mr88" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0017", "reference_id": "RHSA-2023:0017", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "fixed_packages": [], "aliases": [ "CVE-2022-30948", "GHSA-5786-3qjg-mr88" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-c2jh-gx5w-mqcd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/53949?format=api", "vulnerability_id": "VCID-ca7m-fb38-kfe2", "summary": "Lack of authentication mechanism in Jenkins Git Plugin webhook\nGit Plugin provides a webhook endpoint at `/git/notifyCommit` that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Git Plugin 4.11.3 and earlier, this endpoint can be accessed with GET requests and without authentication. In addition to this basic functionality, the endpoint also accept a `sha1` parameter specifying a commit ID. If this parameter is specified, jobs configured with the specified repo will be triggered immediately, and the build will check out the specified commit. Additionally, the output of the webhook endpoint will provide information about which jobs were triggered or scheduled for polling, including jobs the user has no permission to access. This allows attackers with knowledge of Git repository URLs to trigger builds of jobs using a specified Git repository and to cause them to check out an attacker-specified commit, and to obtain information about the existence of jobs configured with this Git repository. Git Plugin 4.11.4 requires a `token` parameter which will act as an authentication for the webhook endpoint. While GET requests remain allowed, attackers would need to be able to provide a webhook token. For more information see [the plugin documentation](https://github.com/jenkinsci/git-plugin/#push-notification-from-repository).", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-36883.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-36883.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-36883", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.78584", "scoring_system": "epss", "scoring_elements": "0.99043", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.78584", "scoring_system": "epss", "scoring_elements": "0.99031", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.78584", "scoring_system": "epss", "scoring_elements": "0.99034", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.78584", "scoring_system": "epss", "scoring_elements": "0.99036", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.78584", "scoring_system": "epss", "scoring_elements": "0.99037", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.78584", "scoring_system": "epss", "scoring_elements": "0.99038", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.78584", "scoring_system": "epss", "scoring_elements": "0.99039", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.78584", "scoring_system": "epss", "scoring_elements": "0.9904", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.78584", "scoring_system": "epss", "scoring_elements": "0.99041", "published_at": "2026-04-18T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-36883" }, { "reference_url": "https://github.com/jenkinsci/git-plugin", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/git-plugin" }, { "reference_url": "https://github.com/jenkinsci/git-plugin/commit/b46165c74a0bf15e08763de2e506005624d5d238", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/git-plugin/commit/b46165c74a0bf15e08763de2e506005624d5d238" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36883", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36883" }, { "reference_url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/07/27/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119656", "reference_id": "2119656", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119656" }, { "reference_url": "https://github.com/advisories/GHSA-v878-67xw-grw2", "reference_id": "GHSA-v878-67xw-grw2", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-v878-67xw-grw2" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0017", "reference_id": "RHSA-2023:0017", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0017" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0560", "reference_id": "RHSA-2023:0560", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0560" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0777", "reference_id": "RHSA-2023:0777", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "fixed_packages": [], "aliases": [ "CVE-2022-36883", "GHSA-v878-67xw-grw2" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ca7m-fb38-kfe2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/15976?format=api", "vulnerability_id": "VCID-fzvq-dpvh-v7eu", "summary": "Cross-Site Request Forgery (CSRF)\nA cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30946.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30946.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30946", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00091", "scoring_system": "epss", "scoring_elements": "0.25563", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00091", "scoring_system": "epss", "scoring_elements": "0.25762", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00091", "scoring_system": "epss", "scoring_elements": "0.25804", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00091", "scoring_system": "epss", "scoring_elements": "0.25575", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00091", "scoring_system": "epss", "scoring_elements": "0.25647", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00091", "scoring_system": "epss", "scoring_elements": "0.25693", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00091", "scoring_system": "epss", "scoring_elements": "0.25703", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00091", "scoring_system": "epss", "scoring_elements": "0.25662", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00091", "scoring_system": "epss", "scoring_elements": "0.25605", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00091", "scoring_system": "epss", "scoring_elements": "0.25607", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00091", "scoring_system": "epss", "scoring_elements": "0.25592", "published_at": "2026-04-18T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30946" }, { "reference_url": "https://github.com/jenkinsci/script-security-plugin", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/script-security-plugin" }, { "reference_url": "https://github.com/jenkinsci/script-security-plugin/commit/35f6a0b8207ed3a32a85f27c1312da6cd738eeaa", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/script-security-plugin/commit/35f6a0b8207ed3a32a85f27c1312da6cd738eeaa" }, { "reference_url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/05/17/8", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119643", "reference_id": "2119643", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119643" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30946", "reference_id": "CVE-2022-30946", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30946" }, { "reference_url": "https://github.com/advisories/GHSA-qwgx-mrv5-87j8", "reference_id": "GHSA-qwgx-mrv5-87j8", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qwgx-mrv5-87j8" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0017", "reference_id": "RHSA-2023:0017", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0017" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0560", "reference_id": "RHSA-2023:0560", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0560" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0777", "reference_id": "RHSA-2023:0777", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "fixed_packages": [], "aliases": [ "CVE-2022-30946", "GHSA-qwgx-mrv5-87j8" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-fzvq-dpvh-v7eu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/53854?format=api", "vulnerability_id": "VCID-gxu6-51zm-sfh7", "summary": "Lack of authentication mechanism in Jenkins Git Plugin webhook\nGit Plugin provides a webhook endpoint at `/git/notifyCommit` that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Git Plugin 4.11.3 and earlier, this endpoint can be accessed with GET requests and without authentication.\n\nThis webhook endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nGit Plugin 4.11.4 requires a `token` parameter which will act as an authentication for the webhook endpoint. While GET requests remain allowed, attackers would need to be able to provide a webhook token. For more information see [the plugin documentation](https://github.com/jenkinsci/git-plugin/#push-notification-from-repository).", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-36882.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-36882.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-36882", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00284", "scoring_system": "epss", "scoring_elements": "0.51803", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00284", "scoring_system": "epss", "scoring_elements": "0.51749", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00284", "scoring_system": "epss", "scoring_elements": "0.51709", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00284", "scoring_system": "epss", "scoring_elements": "0.51764", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00284", "scoring_system": "epss", "scoring_elements": "0.5176", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00284", "scoring_system": "epss", "scoring_elements": "0.5181", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00284", "scoring_system": "epss", "scoring_elements": "0.51789", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00284", "scoring_system": "epss", "scoring_elements": "0.51773", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00284", "scoring_system": "epss", "scoring_elements": "0.51815", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00284", "scoring_system": "epss", "scoring_elements": "0.51821", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00284", "scoring_system": "epss", "scoring_elements": "0.51723", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-36882" }, { "reference_url": "https://github.com/jenkinsci/git-plugin/commit/b46165c74a0bf15e08763de2e506005624d5d238", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/git-plugin/commit/b46165c74a0bf15e08763de2e506005624d5d238" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36882", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36882" }, { "reference_url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/07/27/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116840", "reference_id": "2116840", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116840" }, { "reference_url": "https://github.com/advisories/GHSA-8xwj-2wgh-gprh", "reference_id": "GHSA-8xwj-2wgh-gprh", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-8xwj-2wgh-gprh" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0017", "reference_id": "RHSA-2023:0017", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0017" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0560", "reference_id": "RHSA-2023:0560", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0560" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0777", "reference_id": "RHSA-2023:0777", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "fixed_packages": [], "aliases": [ "CVE-2022-36882", "GHSA-8xwj-2wgh-gprh" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "7.9", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-gxu6-51zm-sfh7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/53777?format=api", "vulnerability_id": "VCID-hg91-mnh3-g3a4", "summary": "Jenkins Git client plugin 3.11.0 does not perform SSH host key verification\nJenkins Git client plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks. Git client Plugin 3.11.1 provides strategies for performing host key verification for administrators to select the one that meets their security needs. For more information see [the plugin documentation](https://github.com/jenkinsci/git-client-plugin#ssh-host-key-verification).", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-36881.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-36881.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-36881", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00739", "scoring_system": "epss", "scoring_elements": "0.72908", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00739", "scoring_system": "epss", "scoring_elements": "0.72915", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00739", "scoring_system": "epss", "scoring_elements": "0.72905", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00739", "scoring_system": "epss", "scoring_elements": "0.72872", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00739", "scoring_system": "epss", "scoring_elements": "0.72816", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00739", "scoring_system": "epss", "scoring_elements": "0.72864", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00739", "scoring_system": "epss", "scoring_elements": "0.7285", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00739", "scoring_system": "epss", "scoring_elements": "0.72812", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00739", "scoring_system": "epss", "scoring_elements": "0.72837", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00739", "scoring_system": "epss", "scoring_elements": "0.72888", "published_at": "2026-04-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-36881" }, { "reference_url": "https://github.com/jenkinsci/git-client-plugin", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/git-client-plugin" }, { "reference_url": "https://github.com/jenkinsci/git-client-plugin/commit/88f52c6c9b18bca4ad210e3b9910a49433583fd9", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/git-client-plugin/commit/88f52c6c9b18bca4ad210e3b9910a49433583fd9" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36881", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36881" }, { "reference_url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/07/27/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2114755", "reference_id": "2114755", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2114755" }, { "reference_url": "https://github.com/advisories/GHSA-cm7j-p8hc-97vj", "reference_id": "GHSA-cm7j-p8hc-97vj", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-cm7j-p8hc-97vj" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7865", "reference_id": "RHSA-2022:7865", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7865" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0017", "reference_id": "RHSA-2023:0017", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "fixed_packages": [], "aliases": [ "CVE-2022-36881", "GHSA-cm7j-p8hc-97vj" ], "risk_score": 3.6, "exploitability": "0.5", "weighted_severity": "7.3", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-hg91-mnh3-g3a4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/13762?format=api", "vulnerability_id": "VCID-k6wy-rwhv-ckd2", "summary": "Incorrect Authorization\nJenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even if the Pipeline is configured to not trust them.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29047.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29047.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-29047", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00064", "scoring_system": "epss", "scoring_elements": "0.2001", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00064", "scoring_system": "epss", "scoring_elements": "0.20192", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00064", "scoring_system": "epss", "scoring_elements": "0.20247", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00064", "scoring_system": "epss", "scoring_elements": "0.19972", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00064", "scoring_system": "epss", "scoring_elements": "0.20052", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00064", "scoring_system": "epss", "scoring_elements": "0.20111", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00064", "scoring_system": "epss", "scoring_elements": "0.20129", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00064", "scoring_system": "epss", "scoring_elements": "0.20083", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00064", "scoring_system": "epss", "scoring_elements": "0.20024", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00064", "scoring_system": "epss", "scoring_elements": "0.20006", "published_at": "2026-04-16T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-29047" }, { "reference_url": "https://github.com/jenkinsci/workflow-cps-global-lib-plugin/commit/97bf32458e60ad252cfe5e7949bacf04459cee64", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/workflow-cps-global-lib-plugin/commit/97bf32458e60ad252cfe5e7949bacf04459cee64" }, { "reference_url": "https://github.com/jenkinsci/workflow-cps-global-lib-plugin/commit/bae59b46cb524549d7f346ba73d3161804c97331", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/workflow-cps-global-lib-plugin/commit/bae59b46cb524549d7f346ba73d3161804c97331" }, { "reference_url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-03T19:16:45Z/" } ], "url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2074855", "reference_id": "2074855", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2074855" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29047", "reference_id": "CVE-2022-29047", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29047" }, { "reference_url": "https://github.com/advisories/GHSA-hh6f-6fp5-gfpv", "reference_id": "GHSA-hh6f-6fp5-gfpv", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-hh6f-6fp5-gfpv" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:2205", "reference_id": "RHSA-2022:2205", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:2205" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:4909", "reference_id": "RHSA-2022:4909", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:4909" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0017", "reference_id": "RHSA-2023:0017", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0017" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:1064", "reference_id": "RHSA-2023:1064", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "fixed_packages": [], "aliases": [ "CVE-2022-29047", "GHSA-hh6f-6fp5-gfpv" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-k6wy-rwhv-ckd2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/54271?format=api", "vulnerability_id": "VCID-qsut-4d83-97h1", "summary": "Arbitrary file write vulnerability in Jenkins Pipeline: Input Step Plugin\nPipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier allows Pipeline authors to specify `file` parameters for Pipeline `input` steps even though they are unsupported. Although the uploaded file is not copied to the workspace, Jenkins archives the file on the controller as part of build metadata using the parameter name without sanitization as a relative path inside a build-related directory.\n\nThis allows attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.\n\nPipeline: Input Step Plugin 449.v77f0e8b_845c4 prohibits use of `file` parameters for Pipeline `input` steps. Attempts to use them will fail Pipeline execution.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-34177.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-34177.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-34177", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00112", "scoring_system": "epss", "scoring_elements": "0.29677", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00112", "scoring_system": "epss", "scoring_elements": "0.29853", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00112", "scoring_system": "epss", "scoring_elements": "0.29899", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00112", "scoring_system": "epss", "scoring_elements": "0.29715", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00112", "scoring_system": "epss", "scoring_elements": "0.29777", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00112", "scoring_system": "epss", "scoring_elements": "0.29813", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00112", "scoring_system": "epss", "scoring_elements": "0.29822", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00112", "scoring_system": "epss", "scoring_elements": "0.29727", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00112", "scoring_system": "epss", "scoring_elements": "0.29744", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00112", "scoring_system": "epss", "scoring_elements": "0.29722", "published_at": "2026-04-18T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-34177" }, { "reference_url": "https://github.com/jenkinsci/pipeline-input-step-plugin", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/pipeline-input-step-plugin" }, { "reference_url": "https://github.com/jenkinsci/pipeline-input-step-plugin/commit/77f0e8b845c4ad429f6c717eab21cf4e7a69168e", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/pipeline-input-step-plugin/commit/77f0e8b845c4ad429f6c717eab21cf4e7a69168e" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34177", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34177" }, { "reference_url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2705", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2705" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103551", "reference_id": "2103551", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103551" }, { "reference_url": "https://github.com/advisories/GHSA-29q6-p2cg-4v23", "reference_id": "GHSA-29q6-p2cg-4v23", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-29q6-p2cg-4v23" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6531", "reference_id": "RHSA-2022:6531", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6531" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:9110", "reference_id": "RHSA-2022:9110", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:9110" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0017", "reference_id": "RHSA-2023:0017", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "fixed_packages": [], "aliases": [ "CVE-2022-34177", "GHSA-29q6-p2cg-4v23" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qsut-4d83-97h1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/54737?format=api", "vulnerability_id": "VCID-rs56-6qvx-vucg", "summary": "Insufficiently Protected Credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin\nWhen pipelines are created using the pipeline creation wizard in Blue Ocean, the credentials used are stored in the per-user credentials store of the user creating the pipeline. To allow pipelines to use this credential to scan repositories and checkout from SCM, the Blue Ocean Credentials Provider allows pipelines to access a specific credential from the per-user credentials store in Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier.\n\nAs a result, attackers with Job/Configure permission can rewrite job configurations in a way that lets them access and capture any attacker-specified credential from any user’s private credentials store.\n\nPipeline SCM API for Blue Ocean Plugin 1.25.4 deprecates the Blue Ocean Credentials Provider and disables it by default. As a result, all jobs initially set up using the Blue Ocean pipeline creation wizard and configured to use the credential specified at that time will no longer be able to access the credential, resulting in failures to scan repositories, checkout from SCM, etc. unless the repository is public and can be accessed without credentials.\n\nThis also applies to newly created pipelines after Pipeline SCM API for Blue Ocean Plugin has been updated to 1.25.4.\n\nAdministrators should reconfigure affected pipelines to use a credential from the Jenkins credential store or a folder credential store. See [this help page on cloudbees.com](https://cloudbees.com/r/blue-ocean-credentials-removal) to learn more.\n\nTo re-enable the Blue Ocean Credentials Provider, set the Java system property `io.jenkins.blueocean.rest.impl.pipeline.credential.BlueOceanCredentialsProvider.enabled` to `true`. Doing so is discouraged, as that will restore the unsafe behavior.\n\nWhile Credentials Plugin provides the _Configure Credential Providers_ UI to enable or disable certain credentials providers, enabling the Blue Ocean Credentials Provider there is not enough in Pipeline SCM API for Blue Ocean Plugin 1.25.4. Both the UI and system property need to enable the Blue Ocean Credentials Provider.\n\nAdministrators not immediately able to update Blue Ocean are advised to disable the Blue Ocean Credentials Provider through the UI at _Manage Jenkins_ » _Configure Credential Providers_ and to reconfigure affected pipelines to use a credential from the Jenkins credential store or a folder credential store.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30952.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30952.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30952", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00289", "scoring_system": "epss", "scoring_elements": "0.52338", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00289", "scoring_system": "epss", "scoring_elements": "0.5231", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59363", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59296", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59347", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59359", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59379", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59362", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59344", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59377", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59383", "published_at": "2026-04-18T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30952" }, { "reference_url": "https://github.com/jenkinsci/blueocean-plugin/commit/c4beeda0b574c297ac664511029feed0a15abaf1", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/blueocean-plugin/commit/c4beeda0b574c297ac664511029feed0a15abaf1" }, { "reference_url": "https://github.com/jenkinsci/blueocean-plugin/tree/master/blueocean-pipeline-scm-api", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/blueocean-plugin/tree/master/blueocean-pipeline-scm-api" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952" }, { "reference_url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/05/17/8", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119645", "reference_id": "2119645", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119645" }, { "reference_url": "https://github.com/advisories/GHSA-g74w-93cp-5p3p", "reference_id": "GHSA-g74w-93cp-5p3p", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-g74w-93cp-5p3p" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0017", "reference_id": "RHSA-2023:0017", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0017" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0560", "reference_id": "RHSA-2023:0560", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0560" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0777", "reference_id": "RHSA-2023:0777", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0777" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:1064", "reference_id": "RHSA-2023:1064", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "fixed_packages": [], "aliases": [ "CVE-2022-30952", "GHSA-g74w-93cp-5p3p" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-rs56-6qvx-vucg" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/54247?format=api", "vulnerability_id": "VCID-tt48-pfzv-mkgt", "summary": "Cross-site Scripting in Jenkins JUnit Plugin\nJUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results.\n\nThis results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.\n\nJUnit Plugin 1119.1121.vc43d0fc45561 applies the configured markup formatter to descriptions of test results.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-34176.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-34176.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-34176", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.5595", "scoring_system": "epss", "scoring_elements": "0.98102", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.5595", "scoring_system": "epss", "scoring_elements": "0.98106", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.5595", "scoring_system": "epss", "scoring_elements": "0.98104", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.5595", "scoring_system": "epss", "scoring_elements": "0.98099", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.61912", "scoring_system": "epss", "scoring_elements": "0.98331", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.61912", "scoring_system": "epss", "scoring_elements": "0.98342", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.61912", "scoring_system": "epss", "scoring_elements": "0.98339", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.61912", "scoring_system": "epss", "scoring_elements": "0.98334", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.61912", "scoring_system": "epss", "scoring_elements": "0.98329", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-34176" }, { "reference_url": "https://github.com/jenkinsci/junit-plugin", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/junit-plugin" }, { "reference_url": "https://github.com/jenkinsci/junit-plugin/commit/c43d0fc455619dd652ec87939ac3d70d6134fea1", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/junit-plugin/commit/c43d0fc455619dd652ec87939ac3d70d6134fea1" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34176", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34176" }, { "reference_url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103548", "reference_id": "2103548", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103548" }, { "reference_url": "https://github.com/advisories/GHSA-64mj-3p92-589v", "reference_id": "GHSA-64mj-3p92-589v", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-64mj-3p92-589v" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6531", "reference_id": "RHSA-2022:6531", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6531" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0017", "reference_id": "RHSA-2023:0017", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "fixed_packages": [], "aliases": [ "CVE-2022-34176", "GHSA-64mj-3p92-589v" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-tt48-pfzv-mkgt" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/53816?format=api", "vulnerability_id": "VCID-ubq1-gzr6-x3fu", "summary": "Lack of authentication mechanism in Jenkins Git Plugin webhook\nGit Plugin provides a webhook endpoint at `/git/notifyCommit` that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Git Plugin 4.11.3 and earlier, this endpoint can be accessed with GET requests and without authentication. In addition to this basic functionality, the endpoint also accept a `sha1` parameter specifying a commit ID. If this parameter is specified, jobs configured with the specified repo will be triggered immediately, and the build will check out the specified commit. Additionally, the output of the webhook endpoint will provide information about which jobs were triggered or scheduled for polling, including jobs the user has no permission to access. This allows attackers with knowledge of Git repository URLs to trigger builds of jobs using a specified Git repository and to cause them to check out an attacker-specified commit, and to obtain information about the existence of jobs configured with this Git repository. Additionally, this webhook endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. Git Plugin 4.11.4 requires a `token` parameter which will act as an authentication for the webhook endpoint. While GET requests remain allowed, attackers would need to be able to provide a webhook token. For more information see [the plugin documentation](https://github.com/jenkinsci/git-plugin/#push-notification-from-repository).", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-36884.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-36884.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-36884", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00512", "scoring_system": "epss", "scoring_elements": "0.66504", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00512", "scoring_system": "epss", "scoring_elements": "0.66469", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00512", "scoring_system": "epss", "scoring_elements": "0.665", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00512", "scoring_system": "epss", "scoring_elements": "0.66512", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00512", "scoring_system": "epss", "scoring_elements": "0.66493", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00512", "scoring_system": "epss", "scoring_elements": "0.66479", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00512", "scoring_system": "epss", "scoring_elements": "0.66433", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00512", "scoring_system": "epss", "scoring_elements": "0.66431", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00512", "scoring_system": "epss", "scoring_elements": "0.6646", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00512", "scoring_system": "epss", "scoring_elements": "0.66506", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00512", "scoring_system": "epss", "scoring_elements": "0.66522", "published_at": "2026-04-18T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-36884" }, { "reference_url": "https://github.com/jenkinsci/git-plugin/commit/b46165c74a0bf15e08763de2e506005624d5d238", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/git-plugin/commit/b46165c74a0bf15e08763de2e506005624d5d238" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36884", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36884" }, { "reference_url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/07/27/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119657", "reference_id": "2119657", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119657" }, { "reference_url": "https://github.com/advisories/GHSA-449w-c77c-vmf6", "reference_id": "GHSA-449w-c77c-vmf6", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-449w-c77c-vmf6" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0017", "reference_id": "RHSA-2023:0017", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0017" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0560", "reference_id": "RHSA-2023:0560", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0560" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0777", "reference_id": "RHSA-2023:0777", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "fixed_packages": [], "aliases": [ "CVE-2022-36884", "GHSA-449w-c77c-vmf6" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ubq1-gzr6-x3fu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/57525?format=api", "vulnerability_id": "VCID-xq5k-dyk9-u3ct", "summary": "Cross Site Request Forgery in Jenkins Blue Ocean Plugin\nA cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server. Blue Ocean Plugin 1.25.4 requires POST requests and the appropriate permissions for the affected HTTP endpoints.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30953.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30953.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30953", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00081", "scoring_system": "epss", "scoring_elements": "0.24133", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00081", "scoring_system": "epss", "scoring_elements": "0.24093", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00107", "scoring_system": "epss", "scoring_elements": "0.2875", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00107", "scoring_system": "epss", "scoring_elements": "0.28782", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00107", "scoring_system": "epss", "scoring_elements": "0.2885", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00107", "scoring_system": "epss", "scoring_elements": "0.28891", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00107", "scoring_system": "epss", "scoring_elements": "0.28897", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00107", "scoring_system": "epss", "scoring_elements": "0.28853", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00107", "scoring_system": "epss", "scoring_elements": "0.28803", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00107", "scoring_system": "epss", "scoring_elements": "0.28824", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00107", "scoring_system": "epss", "scoring_elements": "0.288", "published_at": "2026-04-18T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30953" }, { "reference_url": "https://github.com/jenkinsci/blueocean-plugin", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/blueocean-plugin" }, { "reference_url": "https://github.com/jenkinsci/blueocean-plugin/commit/9f44b895d018c514d5dccc1f2190a2a029e58259", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/blueocean-plugin/commit/9f44b895d018c514d5dccc1f2190a2a029e58259" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30953", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30953" }, { "reference_url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/05/17/8", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119646", "reference_id": "2119646", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119646" }, { "reference_url": "https://github.com/advisories/GHSA-hgpq-42pf-9vfq", "reference_id": "GHSA-hgpq-42pf-9vfq", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-hgpq-42pf-9vfq" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0017", "reference_id": "RHSA-2023:0017", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0017" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0560", "reference_id": "RHSA-2023:0560", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0560" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0777", "reference_id": "RHSA-2023:0777", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0777" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3198", "reference_id": "RHSA-2023:3198", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3198" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3610", "reference_id": "RHSA-2023:3610", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3610" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3622", "reference_id": "RHSA-2023:3622", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3622" } ], "fixed_packages": [], "aliases": [ "CVE-2022-30953", "GHSA-hgpq-42pf-9vfq" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xq5k-dyk9-u3ct" } ], "fixing_vulnerabilities": [], "risk_score": "4.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/jenkins-2-plugins@4.8.1672842762-1%3Farch=el8" }