CVE-2022-34211: 
Java vulnerability analysis and mitigation

A cross-site request forgery (CSRF) vulnerability (CVE-2022-34211) was discovered in Jenkins vRealize Orchestrator Plugin 3.0 and earlier. The vulnerability was disclosed on June 22, 2022, affecting the vmware-vrealize-orchestrator plugin (Jenkins Advisory).

The vulnerability stems from two security issues: a missing permission check in an HTTP endpoint and a CSRF vulnerability. The plugin does not perform proper permission checks in its HTTP endpoint and does not require POST requests, which makes it vulnerable to CSRF attacks. The vulnerability has a CVSS v3 Base Score of 6.5 (Medium) (AttackerKB).

The vulnerability allows attackers with Overall/Read permission to send an HTTP POST request to an attacker-specified URL. This could potentially lead to unauthorized actions being performed on behalf of authenticated users (Jenkins Advisory).

As of the advisory publication date, no fix was available for this vulnerability in the vRealize Orchestrator Plugin. Users running version 3.0 or earlier of the plugin should consider implementing additional security controls or restricting access to the affected endpoints (Jenkins Advisory).