CVE-2022-20612: 
Java vulnerability analysis and mitigation

A cross-site request forgery (CSRF) vulnerability was discovered in Jenkins versions 2.329 and earlier, and LTS 2.319.1 and earlier. The vulnerability was identified as CVE-2022-20612 and was disclosed on January 12, 2022. The issue affects Jenkins core installations where no security realm is set (Jenkins Advisory).

The vulnerability stems from Jenkins not requiring POST requests for the HTTP endpoint that handles manual build requests when no security realm is set. This implementation flaw creates a cross-site request forgery vulnerability. The issue has a CVSS v3.1 base score of 4.3 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (NVD).

When successfully exploited, this vulnerability allows attackers to trigger builds of jobs without parameters. This could potentially lead to unauthorized job executions in Jenkins installations where no security realm is configured (Jenkins Advisory).

The vulnerability requires no authentication and can be exploited remotely, though it does require user interaction. The attack complexity is considered low, making it relatively straightforward to exploit in affected environments (NVD).

The vulnerability was fixed in Jenkins 2.330 and LTS 2.319.2, which now require POST requests for the affected HTTP endpoint. Users are strongly advised to upgrade to these or later versions to address the vulnerability (Jenkins Advisory).