Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-gxu6-51zm-sfh7
Vulnerability ID VCID-gxu6-51zm-sfh7
Aliases CVE-2022-36882
GHSA-8xwj-2wgh-gprh
Summary Lack of authentication mechanism in Jenkins Git Plugin webhook Git Plugin provides a webhook endpoint at `/git/notifyCommit` that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Git Plugin 4.11.3 and earlier, this endpoint can be accessed with GET requests and without authentication. This webhook endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. Git Plugin 4.11.4 requires a `token` parameter which will act as an authentication for the webhook endpoint. While GET requests remain allowed, attackers would need to be able to provide a webhook token. For more information see [the plugin documentation](https://github.com/jenkinsci/git-plugin/#push-notification-from-repository).
Status Published
Exploitability 0.5
Weighted Severity 7.9
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-352 Cross-Site Request Forgery (CSRF)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 8.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-36882.json
epss 0.00284 https://api.first.org/data/v1/epss?cve=CVE-2022-36882
epss 0.00284 https://api.first.org/data/v1/epss?cve=CVE-2022-36882
epss 0.00284 https://api.first.org/data/v1/epss?cve=CVE-2022-36882
epss 0.00284 https://api.first.org/data/v1/epss?cve=CVE-2022-36882
epss 0.00284 https://api.first.org/data/v1/epss?cve=CVE-2022-36882
epss 0.00284 https://api.first.org/data/v1/epss?cve=CVE-2022-36882
epss 0.00284 https://api.first.org/data/v1/epss?cve=CVE-2022-36882
epss 0.00284 https://api.first.org/data/v1/epss?cve=CVE-2022-36882
epss 0.00284 https://api.first.org/data/v1/epss?cve=CVE-2022-36882
epss 0.00284 https://api.first.org/data/v1/epss?cve=CVE-2022-36882
epss 0.00284 https://api.first.org/data/v1/epss?cve=CVE-2022-36882
epss 0.00284 https://api.first.org/data/v1/epss?cve=CVE-2022-36882
epss 0.00284 https://api.first.org/data/v1/epss?cve=CVE-2022-36882
epss 0.00284 https://api.first.org/data/v1/epss?cve=CVE-2022-36882
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-8xwj-2wgh-gprh
cvssv3.1 6.5 https://github.com/jenkinsci/git-plugin/commit/b46165c74a0bf15e08763de2e506005624d5d238
generic_textual MODERATE https://github.com/jenkinsci/git-plugin/commit/b46165c74a0bf15e08763de2e506005624d5d238
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2022-36882
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-36882
cvssv3.1 6.5 https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284
generic_textual MODERATE https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284
cvssv3.1 6.5 http://www.openwall.com/lists/oss-security/2022/07/27/1
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2022/07/27/1
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-36882.json
https://api.first.org/data/v1/epss?cve=CVE-2022-36882
https://github.com/jenkinsci/git-plugin/commit/b46165c74a0bf15e08763de2e506005624d5d238
https://nvd.nist.gov/vuln/detail/CVE-2022-36882
https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284
http://www.openwall.com/lists/oss-security/2022/07/27/1
2116840 https://bugzilla.redhat.com/show_bug.cgi?id=2116840
GHSA-8xwj-2wgh-gprh https://github.com/advisories/GHSA-8xwj-2wgh-gprh
RHSA-2023:0017 https://access.redhat.com/errata/RHSA-2023:0017
RHSA-2023:0560 https://access.redhat.com/errata/RHSA-2023:0560
RHSA-2023:0777 https://access.redhat.com/errata/RHSA-2023:0777
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-36882.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/jenkinsci/git-plugin/commit/b46165c74a0bf15e08763de2e506005624d5d238
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-36882
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at http://www.openwall.com/lists/oss-security/2022/07/27/1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.51723
EPSS Score 0.00284
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:07:21.291996+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-8xwj-2wgh-gprh/GHSA-8xwj-2wgh-gprh.json 38.0.0