Skip to content
Fencer Vulns
medium 4.3

CVE-2022-20612 json

Cross-Site Request Forgery in Jenkins

published 2022-01-12 4 y ago modified 2026-09-08 2 mo ago also BIT-jenkins-2022-20612 , EUVD-2022-0661 , GHSA-p92q-7fhh-mq35

cvss
4.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.9%
EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits
0
none known

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.

Patch / fix

  • maven org.jenkins-ci.main:jenkins-core 2.319.2, 2.330
  • bitnami jenkins 2.329.1
  • cri-o openshift 4.10 1.23.0-92.rhaos4.10.gitdaab4d1.el7
  • cri-o openshift 4.10 1.23.1-9.rhaos4.10.gitbdffb9a.el8
  • jenkins openshift 4.10 2.319.2.1643288987-1.el8
  • openshift openshift 4.10 4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
  • openshift openshift 4.10 4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
  • coreos-installer openshift 4.10 0.12.0-1.rhaos4.10.el8
  • jenkins-2-plugins openshift 4.10 4.10.1643404185-1.el8
  • openshift-clients openshift 4.10 4.10.0-202202160023.p0.gf93da17.assembly.stream.el7

red hat advisories RHSA-2022:0055RHSA-2022:0565RHSA-2022:0555RHSA-2022:0491RHSA-2022:0483RHSA-2022:0339

  • jenkins Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 2.319.2-r0
  • jenkins Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 2.332.1-r0

alpine advisories ALPINE-CVE-2022-20612

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-20612 updated cvss 4.3

jenkins: no POST request is required for the endpoint handling manual build requests which could result in CSRF

  • Red Hat OpenShift Container Platform 3.11 jenkins 2.319.2.1644411558-1.el7
    fixed: vendor fix RHSA-2022:0555
  • Red Hat OpenShift Container Platform 4.6 jenkins 2.319.2.1643964085-1.el8
    fixed: vendor fix RHSA-2022:0565
  • Red Hat OpenShift Container Platform 4.7 jenkins 2.319.2.1643882372-1.el8
    fixed: vendor fix RHSA-2022:0491
  • Red Hat OpenShift Container Platform 4.8 jenkins 2.319.2.1643648617-1.el8
    fixed: vendor fix RHSA-2022:0483
  • Red Hat OpenShift Container Platform 4.9 jenkins 2.319.2.1643391771-1.el8
    fixed: vendor fix RHSA-2022:0339
  • Red Hat OpenShift Container Platform 4.10 jenkins 2.319.2.1643288987-1.el8
    fixed: vendor fix RHSA-2022:0055
  • Red Hat Fuse 7 jenkins Red Hat OpenShift Container Platform 3.11 prometheus 3.11.634-1.g99aae51.el7, jenkins-2-plugins 3.11.1644412543-1.el7, openshift-kuryr 3.11.634-1.g0c4bf66.el7, openshift-kuryr-cni 3.11.634-1.g0c4bf66.el7, atomic-openshift 3.11.634-1.git.0.9b5be6d.el7, openshift-ansible 3.11.634-1.git.0.86bbe6f.el7, +35 more Red Hat OpenShift Container Platform 4.6 cri-o 1.19.4-6.rhaos4.6.git391175b.el7, cri-o 1.19.4-6.rhaos4.6.git391175b.el8, jenkins-2-plugins 4.6.1643965689-1.el8, openshift 4.6.0-202201200342.p0.g35fca9a.assembly.stream.el7, openshift 4.6.0-202201200342.p0.g35fca9a.assembly.stream.el8, openshift-kuryr 4.6.0-202201261116.p0.g74cd766.assembly.stream.el8, +6 more Red Hat OpenShift Container Platform 4.7 jenkins-2-plugins 4.7.1643883495-1.el8 Red Hat OpenShift Container Platform 4.8 containers-common 1-15.rhaos4.8.el8, jenkins-2-plugins 4.8.1643649345-1.el8, cri-o 1.21.4-10.rhaos4.8.gitc058478.el7, cri-o 1.21.4-10.rhaos4.8.gitc058478.el8, openshift 4.8.0-202202050715.p0.gb82a451.assembly.stream.el7, openshift 4.8.0-202202050715.p0.gb82a451.assembly.stream.el8, +6 more Red Hat OpenShift Container Platform 4.9 jenkins-2-plugins 4.9.1643389956-1.el8, openshift 4.9.0-202201261537.p0.g2cb6068.assembly.stream.el7, openshift 4.9.0-202201261537.p0.g2cb6068.assembly.stream.el8, openshift-hyperkube 4.9.0-202201261537.p0.g2cb6068.assembly.stream.el7, openshift-hyperkube 4.9.0-202201261537.p0.g2cb6068.assembly.stream.el8
    +1 more products
    Red Hat OpenShift Container Platform 4.10 buildah 1.19.7-1.el8, haproxy 2.2.19-1.el8, cri-tools 1.23.0-1.el7, cri-tools 1.23.0-1.el8, python-pbr 5.5.1-1.el8ost, buildah-tests 1.19.7-1.el8, +164 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.87% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
GitHub 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
NVD 2.0 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N
OSV 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven org.jenkins-ci.main:jenkins-core
>=2.320, <2.330
<2.319.2
2.330
2.319.2
bitnami jenkins
<2.329.1
2.329.1

Affected products

  • Jenkins project Jenkins

Classification

Weakness
  • CWE-352 Cross-Site Request Forgery
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.