CVE-2022-36886
External Monitor Job Type Plugin does not require POST requests for an HTTP endpoint
A cross-site request forgery (CSRF) vulnerability in Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier allows attackers to create runs of an external job.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A cross-site request forgery (CSRF) vulnerability in Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier allows attackers to create runs of an external job.
- Record
CVE-2022-36886- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
A cross-site request forgery (CSRF) vulnerability in Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier allows attackers to create runs of an external job.
- Record
CVE-2022-36886- Updated
- 2026-11-02
EUVDEUVD-2022-6266 No score
A cross-site request forgery (CSRF) vulnerability in Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier allows attackers to create runs of an external job.
- Record
EUVD-2022-6266- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6x63-hrxg-2hjx
External Monitor Job Type Plugin does not require POST requests for an HTTP endpoint
Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to create runs of an external job.
External Monitor Job Type Plugin 192.ve979ca_8b_3ccd requires POST requests for the affected HTTP endpoint.
- Record
GHSA-6x63-hrxg-2hjx- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-6x63-hrxg-2hjx
External Monitor Job Type Plugin does not require POST requests for an HTTP endpoint
Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to create runs of an external job.
External Monitor Job Type Plugin 192.ve979ca_8b_3ccd requires POST requests for the affected HTTP endpoint.
- Record
GHSA-6x63-hrxg-2hjx- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:external-monitor-jobMaven |
through 191.v363d0d1efdf8 | 192.ve979ca_8b_3ccd |
org.jenkins-ci.plugins:external-monitor-jobMaven |
before 192.ve979ca_8b_3ccd, plus listed versions 1.01.11.21.31.4 Show 6 moreShow less1.51.61.71.7.1189.v849257a_0d3a_c191.v363d0d1efdf8 |
192.ve979ca_8b_3ccd |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-36886 is a medium vulnerability (CVSS 4.3) in Jenkins External Monitor Job Type, published July 27, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 36th percentile. Fixed in org.jenkins-ci.plugins:external-monitor-job 192.ve979ca_8b_3ccd.