CVE-2022-36882: Cross-Site Request Forgery (CSRF)

July 27, 2022 (updated November 22, 2023)

A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.

References

www.openwall.com/lists/oss-security/2022/07/27/1
nvd.nist.gov/vuln/detail/CVE-2022-36882
www.jenkins.io/security/advisory/2022-07-27/

Code Behaviors & Features

Detect and mitigate CVE-2022-36882 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →