CVE-2022-36887
Jenkins Job Configuration History Plugin does not require POST requests for several HTTP endpoints
A cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier allows attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier allows attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations.
- Record
CVE-2022-36887- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
A cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier allows attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations.
- Record
CVE-2022-36887- Updated
- 2026-11-02
EUVDEUVD-2022-6361 No score
A cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier allows attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations.
- Record
EUVD-2022-6361- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j896-j72w-cr32
Jenkins Job Configuration History Plugin does not require POST requests for several HTTP endpoints
Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier does not require POST requests for several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities.
These vulnerabilities allow attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations.
Job Configuration History Plugin 1156.v536a_97b_8d649 requires POST requests for the affected HTTP endpoints.
- Record
GHSA-j896-j72w-cr32- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-j896-j72w-cr32
Jenkins Job Configuration History Plugin does not require POST requests for several HTTP endpoints
Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier does not require POST requests for several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities.
These vulnerabilities allow attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations.
Job Configuration History Plugin 1156.v536a_97b_8d649 requires POST requests for the affected HTTP endpoints.
- Record
GHSA-j896-j72w-cr32- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:jobConfigHistoryMaven |
through 1155.v28a | 1156.v536a_97b_8d649 |
org.jenkins-ci.plugins:jobConfigHistoryMaven |
before 1156.v536a_97b_8d649, plus listed versions 1.101.111.121.131119.v509e1017356b_ Show 45 moreShow less1133.v0f5420f850531139.v888b_656ca_f6d1146.v94c2521f92131148.v8607da_ef251e1155.v28a_46a_cc06a_52.02.12.1.12.102.112.122.132.142.152.162.172.182.18.12.18.22.18.32.192.22.202.212.222.232.23.12.242.252.262.272.282.28.12.292.29-rc1073.41ef89cf4e152.32.302.31-rc1092.de9e11acbcf32.31-rc1098.b666422863b22.31-rc1107.2354f08725a_82.31-rc1118.fdcd7d8898ff2.42.52.62.8 |
1156.v536a_97b_8d649 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-36887 is a medium vulnerability (CVSS 4.3) in Jenkins Job Configuration History, published July 27, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 36th percentile. Fixed in org.jenkins-ci.plugins:jobConfigHistory 1156.v536a_97b_8d649.
References
Left out here: 1 version. The JSON record has them.