CVE-2022-43408: medium-severity vulnerability in Jenkins Pipeline: Stage View Plugin
Published · Updated
Follow this CVE+ Monitor Jenkins Pipeline: Stage View Plugin+ Monitor org.jenkins-ci.plugins.pipeline-stage-view:pipeline-stage-view
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.5%
Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proceed or abort Pipeline builds, allowing attackers able to configure Pipelines to specify 'input' step IDs resulting in URLs that would bypass the CSRF protection of any target URL in Jenkins.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected products
Jenkins project · Jenkins Pipeline: Stage View Plugin