Maven/org.jenkins-ci.plugins:jobConfigHistory CVE-2022-36887: medium 4.3, EPSS 0.41%
Jenkins Job Configuration History Plugin does not require POST requests for several HTTP endpoints
Action: Upgrade org.jenkins-ci.plugins:jobConfigHistory to 1156.v536a_97b_8d649 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1156.v536a_97b_8d649 | - |
Fixed versions
| 1156.v536a_97b_8d649 |
Sources
- osv: GHSA-j896-j72w-cr32
- https://nvd.nist.gov/vuln/detail/CVE-2022-36887
- https://github.com/jenkinsci/job-config-history-plugin/commit/536a97b8d649b3114f5db24ea32a7c63188a35c6
- https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2766
- http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE-2022-36887 · published · modified · JSON