CVE-2022-25198: 
Java vulnerability analysis and mitigation

A cross-site request forgery (CSRF) vulnerability was discovered in Jenkins SCP publisher Plugin version 1.8 and earlier, identified as CVE-2022-25198. The vulnerability was disclosed on February 15, 2022, affecting the Jenkins SCP publisher Plugin, which is used for publishing artifacts via SCP (Jenkins Advisory, NVD).

The vulnerability stems from a missing permission check in a method implementing form validation, combined with the absence of POST request requirements. The severity is rated as Medium with a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

The vulnerability allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified username and password credentials. This could potentially lead to unauthorized access and credential exposure (Jenkins Advisory).

As of the advisory publication date, no fix was available for this vulnerability in the SCP publisher Plugin. Users are advised to assess their risk and consider implementing additional security controls until a patch becomes available (Jenkins Advisory).