CVE-2022-41249: 
Java vulnerability analysis and mitigation

CVE-2022-41249 is a Cross-Site Request Forgery (CSRF) vulnerability discovered in the Jenkins SCM HttpClient Plugin version 1.5 and earlier, disclosed on September 21, 2022. The vulnerability affects the form validation functionality of the plugin and is tracked alongside CVE-2022-41250 as part of security issue SECURITY-2708 (Jenkins Advisory).

The vulnerability stems from a missing requirement for POST requests in a method implementing form validation within the SCM HttpClient Plugin. The issue has been assigned a Medium severity (CVSS) rating. The vulnerability exists in conjunction with a missing permission check (CVE-2022-41250), creating a combined security weakness in the plugin's form validation implementation (Jenkins Advisory).

The vulnerability allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, potentially leading to the capture of credentials stored in Jenkins (Jenkins Advisory).

As of the security advisory's publication date, no fix is available for this vulnerability in the SCM HttpClient Plugin. Users should monitor for updates and consider implementing additional access controls to limit exposure to the vulnerable form validation endpoint (Jenkins Advisory).