CVE-2022-23106

CVE-2022-23106: vulnerability in Jenkins Configuration as Code Plugin

Published · Updated

Follow this CVE+ Monitor Jenkins Configuration as Code Plugin+ Monitor io.jenkins:configuration-as-code

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.2%
Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token.
Affected products
Jenkins project · Jenkins Configuration as Code Plugin
Related CVEs — Jenkins Configuration as Code Plugin

In the same product, most dangerous first.

CVE-2019-10362—CVE-2019-10362EPSS 0.7%CVE-2019-10344—CVE-2019-10344EPSS 0.7%CVE-2019-10363—CVE-2019-10363EPSS 0.6%CVE-2019-10367—CVE-2019-10367EPSS 0.4%CVE-2019-10343—CVE-2019-10343EPSS 0.4%CVE-2019-10345—CVE-2019-10345EPSS 0.3%