Every CVE Search/ Get API key

CVE-2022-36883

Lack of authentication mechanism in Jenkins Git Plugin webhook

7.5 HighPublic exploitFix available

A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

7.00%Up 6.1 points since Jul 28, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.

Record
CVE-2022-36883
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-862
Updated
2026-11-02
CVE List No score

A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.

Record
CVE-2022-36883
Updated
2026-11-02
EUVDEUVD-2022-6419 No score

A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.

Record
EUVD-2022-6419
Updated
2026-11-03
GitHub AdvisoriesGHSA-v878-67xw-grw2 6.5

Lack of authentication mechanism in Jenkins Git Plugin webhook

Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Git Plugin 4.11.3 and earlier, this endpoint can be accessed with GET requests and without authentication. In addition to this basic functionality, the endpoint also accept a sha1 parameter specifying a commit ID. If this parameter is specified, jobs configured with the specified repo will be triggered immediately, and the build will check out the specified commit. Additionally, the output of the webhook endpoint will provide information about which jobs were triggered or scheduled for polling, including jobs the user has no permission to access. This allows attackers with knowledge of Git repository URLs to trigger builds of jobs using a specified Git repository and to cause them to check out an attacker-specified commit, and to obtain information about the existence of jobs configured with this Git repository. Git Plugin 4.11.4 requires a token parameter which will act as an authentication for the webhook endpoint. While GET requests remain allowed, attackers would need to be able to provide a webhook token. For more information see the plugin documentation.

Record
GHSA-v878-67xw-grw2
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-862
Updated
2026-11-02
OSV 7.5

A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.

Record
CVE-2022-36883
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVGHSA-v878-67xw-grw2 6.5

Lack of authentication mechanism in Jenkins Git Plugin webhook

Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Git Plugin 4.11.3 and earlier, this endpoint can be accessed with GET requests and without authentication. In addition to this basic functionality, the endpoint also accept a sha1 parameter specifying a commit ID. If this parameter is specified, jobs configured with the specified repo will be triggered immediately, and the build will check out the specified commit. Additionally, the output of the webhook endpoint will provide information about which jobs were triggered or scheduled for polling, including jobs the user has no permission to access. This allows attackers with knowledge of Git repository URLs to trigger builds of jobs using a specified Git repository and to cause them to check out an attacker-specified commit, and to obtain information about the existence of jobs configured with this Git repository. Git Plugin 4.11.4 requires a token parameter which will act as an authentication for the webhook endpoint. While GET requests remain allowed, attackers would need to be able to provide a webhook token. For more information see the plugin documentation.

Record
GHSA-v878-67xw-grw2
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-862
Updated
2026-11-02
OSVRHSA-2023:0017 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.8.56 packages and security update

Record
RHSA-2023:0017
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:0560 9.9

Red Hat Security Advisory: OpenShift Container Platform 4.10.51 security update

Record
RHSA-2023:0560
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:0777 9.9

Red Hat Security Advisory: OpenShift Container Platform 4.9.56 security update

Record
RHSA-2023:0777
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.plugins:git
Maven
 through 4.11.3
4.11.4
org.jenkins-ci.plugins:git
Maven
 before 4.11.4, plus listed versions
1.2.01.3.01.4.01.5.01.6.0-beta-1
Show 45 moreShow less
2.02.0-beta-22.0-beta-32.0.12.0.22.0.32.0.42.1.02.2.02.2.12.2.102.2.112.2.122.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.32.3-beta-12.3-beta-22.3-beta-32.3-beta-42.3.12.3.22.3.32.3.42.3.52.4.02.4.12.4.22.4.32.4.42.5.02.5.0-beta12.5.0-beta22.5.0-beta32.5.0-beta42.5.0-beta52.5.12.5.22.5.3
4.11.4
jenkins
Red Hat:openshift:4.8::el8
From an advisory covering 16 CVEs
 before 0:2.361.1.1672840472-1.el8
0:2.361.1.1672840472-1.el8
jenkins-2-plugins
Red Hat:openshift:4.8::el8
From an advisory covering 16 CVEs
 before 0:4.8.1672842762-1.el8
0:4.8.1672842762-1.el8
jenkins-2-plugins
Red Hat:openshift:4.10::el8
From an advisory covering 23 CVEs
 before 0:4.10.1675144701-1.el8
0:4.10.1675144701-1.el8
jenkins-2-plugins
Red Hat:openshift:4.9::el8
From an advisory covering 26 CVEs
 before 0:4.9.1675668922-1.el8
0:4.9.1675668922-1.el8
jenkins
Red Hat:openshift:4.9::el8
From an advisory covering 26 CVEs
 before 0:2.361.1.1675668150-1.el8
0:2.361.1.1675668150-1.el8

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubsuperjimmygou/CVE-2022-368832026-03-26
NucleiJenkins Git <=4.11.3 - Missing Authorization

History

History
RecordedChangedSources
affected, exploits, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-36883 is a high vulnerability (CVSS 7.5) in Jenkins Git, published July 27, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.00%, the 94th percentile. Fixed in org.jenkins-ci.plugins:git 4.11.4.

References

Show 145 moreShow less
This page doesn't list everything

Left out here: 102 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open