Cross Site Request Forgery in Jenkins Storable Configs Plugin
Date: 2022-05
Affected: maven/org.jvnet.hudson.plugins:storable-configs-plugin
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2022-30947
CVE-2022-30948
CVE-2022-30949
CVE-2022-30950
CVE-2022-30951
CVE-2022-30971
CVE-2022-30972
CWE: CWE-120
CWE-22
CWE-352
CWE-611
CWE-862
CVSS: 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)

A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e.g., archived artifacts) that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.


Mitigations:

Architectural layers (MAESTRO):