CVE-2022-23111
Published: 12 January 2022
Summary
CVE-2022-23111 is a medium-severity CSRF (CWE-352) vulnerability in Jenkins Publish Over Ssh. Its CVSS base score is 4.3 (Medium).
Operationally, ranked in the top 6.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a cross-site request forgery (CSRF) flaw, tracked as CVE-2022-23111 with CWE-352, affecting the Jenkins Publish Over SSH Plugin in versions 1.22 and earlier. It carries a CVSS 3.1 score of 4.3 and stems from insufficient protection against forged requests that can manipulate SSH connection settings within the Jenkins automation server.
An unauthenticated attacker can exploit the issue by crafting a malicious web page or link that, when visited by an authenticated Jenkins user, causes the server to initiate an outbound connection to an attacker-specified SSH host using attacker-supplied credentials. Successful exploitation allows the attacker to establish SSH sessions under the plugin's configured identity without direct access to Jenkins or the target credentials.
The official Jenkins security advisory published on 2022-01-12, along with the corresponding oss-security disclosure, directs administrators to upgrade the Publish Over SSH Plugin to a patched release that enforces CSRF tokens on the affected configuration endpoints. No other mitigations such as workarounds are specified in the references. The EPSS score has remained flat at 0.0979 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-0524
Vulnerability details
A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF.
Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation.
Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications.
Detects anomalous request patterns consistent with cross-site request forgery.