CVE-2022-30972: Cross-Site Request Forgery (CSRF)

May 18, 2022 (updated June 1, 2022)

A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e.g., archived artifacts) that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

References

github.com/advisories/GHSA-rr2r-g6xm-58xj
nvd.nist.gov/vuln/detail/CVE-2022-30972
www.jenkins.io/security/advisory/2022-05-17/

Code Behaviors & Features

Detect and mitigate CVE-2022-30972 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →