Vulnerability DatabaseCVE-2022-25192

CVE-2022-25192:
Java vulnerability analysis and mitigation

Overview

A cross-site request forgery (CSRF) vulnerability was discovered in Jenkins Snow Commander Plugin version 1.10 and earlier. The vulnerability was identified with CVE-2022-25192 and was disclosed on February 15, 2022. The affected component is the Snow Commander Plugin (embotics-vcommander) which is used in Jenkins installations (Jenkins Advisory).

Technical details

The vulnerability stems from form validation methods that do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. Additionally, the plugin does not perform proper permission checks in methods implementing form validation. The severity of this vulnerability is rated as Medium according to the CVSS scoring system (Jenkins Advisory).

Impact

This vulnerability allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, potentially leading to the capture of credentials stored in Jenkins (Jenkins Advisory).

Mitigation and workarounds

The vulnerability has been fixed in Snow Commander Plugin version 2.0, which requires POST requests and Overall/Administer permission for the affected form validation methods. Users are advised to upgrade to this version to mitigate the vulnerability (Jenkins Advisory).