CVE-2022-46688: 
Java vulnerability analysis and mitigation

The Sonar Gerrit Plugin version 377.v8f3808963dc5 and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability identified as CVE-2022-46688. The vulnerability was discovered by Oleg Nenashev of CloudBees, Inc. and was disclosed in the Jenkins Security Advisory on December 7, 2022. This security issue affects the HTTP endpoint implementation in the plugin (Jenkins Advisory).

The vulnerability stems from the plugin's failure to require POST requests for an HTTP endpoint, which results in a cross-site request forgery (CSRF) vulnerability. The severity of this vulnerability is rated as Medium according to the CVSS scoring system (Jenkins Advisory).

The vulnerability allows attackers to force Jenkins to connect to Gerrit servers that were previously configured by Jenkins administrators. The attacker can use credentials IDs obtained through other methods, potentially leading to the capture of credentials stored in Jenkins (Jenkins Advisory).

As of the advisory's publication date (December 7, 2022), no fixes were available for the Sonar Gerrit Plugin. The vulnerability affects all versions up to and including 377.v8f3808963dc5 (Jenkins Advisory).