CVE-2022-30946

CSRF vulnerability in Jenkins Script Security Plugin

4.3 MediumFix available

A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.65%Down 0.2 points since May 18, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2022-30946
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-352
Updated: 2026-11-02

CVE List No score

Record: CVE-2022-30946
Updated: 2026-11-02

EUVDEUVD-2022-5046 No score

Record: EUVD-2022-5046
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qwgx-mrv5-87j8 4.3

CSRF vulnerability in Jenkins Script Security Plugin

Record: GHSA-qwgx-mrv5-87j8
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness: CWE-352
Updated: 2026-11-02

OSV 4.3

Record: CVE-2022-30946
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVGHSA-qwgx-mrv5-87j8 4.3

CSRF vulnerability in Jenkins Script Security Plugin

Record: GHSA-qwgx-mrv5-87j8
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness: CWE-352
Updated: 2026-11-02

OSVRHSA-2023:0017 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.8.56 packages and security update

Record: RHSA-2023:0017
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:0560 9.9

Red Hat Security Advisory: OpenShift Container Platform 4.10.51 security update

Record: RHSA-2023:0560
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:0777 9.9

Red Hat Security Advisory: OpenShift Container Platform 4.9.56 security update

Record: RHSA-2023:0777
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.plugins:script-security` Maven	through 1158.v7c1b	1172.v35f6a
`org.jenkins-ci.plugins:script-security` Maven	before 1172.v35f6a, plus listed versions 1.01.0-beta-11.0-beta-21.0-beta-31.0-beta-4 Show 45 moreShow less 1.0-beta-51.0-beta-61.11.101.111.121.131.141.151.161.171.181.18.11.191.21.201.211.221.231.241.251.261.271.281.291.29.11.31.301.311.331.341.351.361.371.381.391.41.401.411.421.431.441.44.11.451.46	1172.v35f6a
`jenkins` Red Hat:openshift:4.8::el8 From an advisory covering 16 CVEs	before 0:2.361.1.1672840472-1.el8	0:2.361.1.1672840472-1.el8
`jenkins-2-plugins` Red Hat:openshift:4.8::el8 From an advisory covering 16 CVEs	before 0:4.8.1672842762-1.el8	0:4.8.1672842762-1.el8
`jenkins-2-plugins` Red Hat:openshift:4.10::el8 From an advisory covering 23 CVEs	before 0:4.10.1675144701-1.el8	0:4.10.1675144701-1.el8
`jenkins-2-plugins` Red Hat:openshift:4.9::el8 From an advisory covering 26 CVEs	before 0:4.9.1675668922-1.el8	0:4.9.1675668922-1.el8
`jenkins` Red Hat:openshift:4.9::el8 From an advisory covering 26 CVEs	before 0:2.361.1.1675668150-1.el8	0:2.361.1.1675668150-1.el8

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-30946 is a medium vulnerability (CVSS 4.3) in Jenkins Script Security, published May 17, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. Fixed in org.jenkins-ci.plugins:script-security 1172.v35f6a.

References

Show 145 moreShow less

This page doesn't list everything

Left out here: 65 versions. The JSON record has them.