CVE-2022-30946 (Medium) detected in script-security-1.54.jar - autoclosed

[mend-for-github-com[bot]]

CVE-2022-30946 - Medium Severity Vulnerability

Vulnerable Library - script-security-1.54.jar

Allows Jenkins administrators to control what in-process scripts can be run by less-privileged users.

Library home page: https://wiki.jenkins.io/display/JENKINS/Script+Security+Plugin

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.plugins/script-security/1.54/f3a86e493aadee03660779add827d0f6384d0120/script-security-1.54.jar

Dependency Hierarchy: - :x: **script-security-1.54.jar** (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver.

Publish Date: 2022-05-17

URL: CVE-2022-30946

CVSS 3 Score Details (4.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116

Release Date: 2022-05-17

Fix Resolution: org.jenkins-ci.plugins:script-security:1172.v35f6a_0b_8207e

---

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.