Every CVE Search/ Get API key

CVE-2022-36884

Lack of authentication mechanism in Jenkins Git Plugin webhook

5.3 MediumFix available

The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

1.09%Up 0.2 points since Jul 28, 2022
90%50%10%1%

What each source reports

NVD Score used 5.3

The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository.

Record
CVE-2022-36884
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-306
Updated
2026-11-02
CVE List No score

The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository.

Record
CVE-2022-36884
Updated
2026-11-02
EUVDEUVD-2022-6223 No score

The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository.

Record
EUVD-2022-6223
Updated
2026-11-03
GitHub AdvisoriesGHSA-449w-c77c-vmf6 5.3

Lack of authentication mechanism in Jenkins Git Plugin webhook

Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Git Plugin 4.11.3 and earlier, this endpoint can be accessed with GET requests and without authentication. In addition to this basic functionality, the endpoint also accept a sha1 parameter specifying a commit ID. If this parameter is specified, jobs configured with the specified repo will be triggered immediately, and the build will check out the specified commit. Additionally, the output of the webhook endpoint will provide information about which jobs were triggered or scheduled for polling, including jobs the user has no permission to access. This allows attackers with knowledge of Git repository URLs to trigger builds of jobs using a specified Git repository and to cause them to check out an attacker-specified commit, and to obtain information about the existence of jobs configured with this Git repository. Additionally, this webhook endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. Git Plugin 4.11.4 requires a token parameter which will act as an authentication for the webhook endpoint. While GET requests remain allowed, attackers would need to be able to provide a webhook token. For more information see the plugin documentation.

Record
GHSA-449w-c77c-vmf6
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200, CWE-306
Updated
2026-11-02
OSV 5.3

The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository.

Record
CVE-2022-36884
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVGHSA-449w-c77c-vmf6 5.3

Lack of authentication mechanism in Jenkins Git Plugin webhook

Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Git Plugin 4.11.3 and earlier, this endpoint can be accessed with GET requests and without authentication. In addition to this basic functionality, the endpoint also accept a sha1 parameter specifying a commit ID. If this parameter is specified, jobs configured with the specified repo will be triggered immediately, and the build will check out the specified commit. Additionally, the output of the webhook endpoint will provide information about which jobs were triggered or scheduled for polling, including jobs the user has no permission to access. This allows attackers with knowledge of Git repository URLs to trigger builds of jobs using a specified Git repository and to cause them to check out an attacker-specified commit, and to obtain information about the existence of jobs configured with this Git repository. Additionally, this webhook endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. Git Plugin 4.11.4 requires a token parameter which will act as an authentication for the webhook endpoint. While GET requests remain allowed, attackers would need to be able to provide a webhook token. For more information see the plugin documentation.

Record
GHSA-449w-c77c-vmf6
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200, CWE-306
Updated
2026-11-02
OSVRHSA-2023:0017 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.8.56 packages and security update

Record
RHSA-2023:0017
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:0560 9.9

Red Hat Security Advisory: OpenShift Container Platform 4.10.51 security update

Record
RHSA-2023:0560
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:0777 9.9

Red Hat Security Advisory: OpenShift Container Platform 4.9.56 security update

Record
RHSA-2023:0777
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.plugins:git
Maven
 through 4.11.3
4.11.4
org.jenkins-ci.plugins:git
Maven
 before 4.11.4, plus listed versions
1.2.01.3.01.4.01.5.01.6.0-beta-1
Show 45 moreShow less
2.02.0-beta-22.0-beta-32.0.12.0.22.0.32.0.42.1.02.2.02.2.12.2.102.2.112.2.122.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.32.3-beta-12.3-beta-22.3-beta-32.3-beta-42.3.12.3.22.3.32.3.42.3.52.4.02.4.12.4.22.4.32.4.42.5.02.5.0-beta12.5.0-beta22.5.0-beta32.5.0-beta42.5.0-beta52.5.12.5.22.5.3
4.11.4
jenkins
Red Hat:openshift:4.8::el8
From an advisory covering 16 CVEs
 before 0:2.361.1.1672840472-1.el8
0:2.361.1.1672840472-1.el8
jenkins-2-plugins
Red Hat:openshift:4.8::el8
From an advisory covering 16 CVEs
 before 0:4.8.1672842762-1.el8
0:4.8.1672842762-1.el8
jenkins-2-plugins
Red Hat:openshift:4.10::el8
From an advisory covering 23 CVEs
 before 0:4.10.1675144701-1.el8
0:4.10.1675144701-1.el8
jenkins-2-plugins
Red Hat:openshift:4.9::el8
From an advisory covering 26 CVEs
 before 0:4.9.1675668922-1.el8
0:4.9.1675668922-1.el8
jenkins
Red Hat:openshift:4.9::el8
From an advisory covering 26 CVEs
 before 0:2.361.1.1675668150-1.el8
0:2.361.1.1675668150-1.el8

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-36884 is a medium vulnerability (CVSS 5.3) in Jenkins Git, published July 27, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in org.jenkins-ci.plugins:git 4.11.4.

References

Show 144 moreShow less
This page doesn't list everything

Left out here: 102 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open