CVE-2022-23111: 
Java vulnerability analysis and mitigation

A cross-site request forgery (CSRF) vulnerability was identified in Jenkins Publish Over SSH Plugin version 1.22 and earlier, tracked as CVE-2022-23111. The vulnerability was disclosed on January 12, 2022, affecting the Jenkins Publish Over SSH Plugin, which is used for publishing artifacts over SSH connections (Jenkins Advisory).

The vulnerability stems from the plugin's failure to require POST requests for methods implementing connection tests. This security flaw is rated as Medium severity according to CVSS scoring system. The vulnerability is tracked under SECURITY-2290 and involves both a CSRF vulnerability (CVE-2022-23111) and a missing permission check (CVE-2022-23112) (Jenkins Advisory).

The vulnerability allows attackers with Overall/Read access to connect to an attacker-specified SSH server using attacker-specified credentials. This could potentially lead to unauthorized access and credential exposure (Jenkins Advisory).

As of the advisory publication date, no official fix was available for this vulnerability in the Publish Over SSH Plugin. Users of version 1.22 and earlier versions of the plugin should monitor for updates and consider implementing additional security controls to protect against unauthorized SSH connections (Jenkins Advisory).