CVE-2022-41230: 
Java vulnerability analysis and mitigation

CVE-2022-41230 is a medium severity vulnerability affecting the Jenkins build-publisher Plugin version 1.22 and earlier, discovered and reported by Matt Sicker from CloudBees, Inc. The vulnerability was disclosed on September 21, 2022, as part of Jenkins Security Advisory 2022-09-21 (Jenkins Advisory).

The vulnerability stems from a missing permission check in an HTTP endpoint within the build-publisher Plugin. The issue has been assigned a medium severity rating based on its CVSS score (Rapid7).

The vulnerability allows attackers with Overall/Read permission to obtain names and URLs of Jenkins servers that the plugin is configured to publish builds to, as well as builds pending for publication to those Jenkins servers (Jenkins Advisory).

The vulnerability can be exploited by attackers who have Overall/Read permission in the Jenkins environment. The attack vector requires network access to the affected Jenkins instance (Jenkins Advisory).

As of the advisory publication date, there is no fix available for this vulnerability in the build-publisher Plugin. Users should assess their risk and consider implementing additional access controls or monitoring measures (Jenkins Advisory).