CVE-2022-20613

Cross-Site Request Forgery in Jenkins Mailer Plugin

4.3 MediumFix available

A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.99%Up 0.1 points since Feb 8, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2022-20613
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-352
Updated: 2026-11-02

CVE List No score

Record: CVE-2022-20613
Updated: 2026-11-02

EUVDEUVD-2022-0518 No score

Record: EUVD-2022-0518
Updated: 2026-11-03

GitHub AdvisoriesGHSA-85rq-hp8x-ghjq 4.3

Cross-Site Request Forgery in Jenkins Mailer Plugin

Jenkins Mailer Plugin prior to 408.vd726a_1130320 and 1.34.2 does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Mailer Plugin 408.vd726a_1130320 and 1.34.2 require POST requests and Overall/Administer permission for the affected form validation method.

Record: GHSA-85rq-hp8x-ghjq
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness: CWE-352
Updated: 2026-11-02

OSV 4.3

Record: CVE-2022-20613
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVGHSA-85rq-hp8x-ghjq 4.3

Cross-Site Request Forgery in Jenkins Mailer Plugin

Jenkins Mailer Plugin prior to 408.vd726a_1130320 and 1.34.2 does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Mailer Plugin 408.vd726a_1130320 and 1.34.2 require POST requests and Overall/Administer permission for the affected form validation method.

Record: GHSA-85rq-hp8x-ghjq
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness: CWE-352
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.plugins:mailer` Maven	391.ve4a38c1bcf4b up to 408.vd726a	408.vd726a
`org.jenkins-ci.plugins:mailer` Maven	before 1.34.2	1.34.2
`org.jenkins-ci.plugins:mailer` Maven	391.ve4a38c1bcf4b up to 408.vd726a, plus listed versions 391.ve4a_38c1b_cf4b_	408.vd726a
`org.jenkins-ci.plugins:mailer` Maven	before 1.34.2, plus listed versions 1.11.101.111.121.12-beta-1 Show 34 moreShow less 1.131.141.151.161.171.181.191.21.201.211.221.231.23-beta-21.241.251.261.271.281.291.29.11.31.301.311.31.11.321.32.11.331.341.41.51.61.71.81.9	1.34.2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-20613 is a medium vulnerability (CVSS 4.3) in Jenkins Mailer, published January 12, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.99%, the 62nd percentile. Fixed in org.jenkins-ci.plugins:mailer 408.vd726a.