CVE-2022-20612
Cross-Site Request Forgery in Jenkins
4.3 MediumFix available
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
1.81%Up 0.9 points since Feb 8, 2022
What each source reports
NVD Score used
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.
- Record
CVE-2022-20612- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:P/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.
- Record
CVE-2022-20612- Updated
- 2026-11-02
EUVDEUVD-2022-0661 No score
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.
- Record
EUVD-2022-0661- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p92q-7fhh-mq35
Cross-Site Request Forgery in Jenkins
Jenkins 2.329 and earlier, LTS 2.319.1 and earlier does not require POST requests for the HTTP endpoint handling manual build requests when no security realm is set, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to trigger build of job without parameters.
Jenkins 2.330, LTS 2.319.2 requires POST requests for the affected HTTP endpoint.
- Record
GHSA-p92q-7fhh-mq35- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-20612
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.
- Record
ALPINE-CVE-2022-20612- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
OSV
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.
- Record
CVE-2022-20612- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVGHSA-p92q-7fhh-mq35
Cross-Site Request Forgery in Jenkins
Jenkins 2.329 and earlier, LTS 2.319.1 and earlier does not require POST requests for the HTTP endpoint handling manual build requests when no security realm is set, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to trigger build of job without parameters.
Jenkins 2.330, LTS 2.319.2 requires POST requests for the affected HTTP endpoint.
- Record
GHSA-p92q-7fhh-mq35- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVRHSA-2022:0055
Red Hat Security Advisory: OpenShift Container Platform 4.10.3 bug fix and security update
- Record
RHSA-2022:0055- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2022:0339
Red Hat Security Advisory: OpenShift Container Platform 4.9.19 security update
- Record
RHSA-2022:0339- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2022:0483
Red Hat Security Advisory: OpenShift Container Platform 4.8.31 security update
- Record
RHSA-2022:0483- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2022:0491
Red Hat Security Advisory: OpenShift Container Platform 4.7.43 security update
- Record
RHSA-2022:0491- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2022:0555
Red Hat Security Advisory: OpenShift Container Platform 3.11.634 security update
- Record
RHSA-2022:0555- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2022:0565
Red Hat Security Advisory: OpenShift Container Platform 4.6.55 packages and security update
- Record
RHSA-2022:0565- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-jenkins-2022-20612 No score
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.
- Record
BIT-jenkins-2022-20612- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven |
before 2.319.2 | 2.319.2 |
org.jenkins-ci.main:jenkins-coreMaven |
2.320 up to 2.330 | 2.330 |
jenkinsAlpine:v3.12 |
before 2.319.2-r0 | 2.319.2-r0 |
jenkinsAlpine:v3.13 |
before 2.319.2-r0 | 2.319.2-r0 |
jenkinsAlpine:v3.14 |
before 2.319.2-r0 | 2.319.2-r0 |
jenkinsAlpine:v3.15 |
before 2.319.2-r0 | 2.319.2-r0 |
jenkinsAlpine:v3.16 |
before 2.319.2-r0 | 2.319.2-r02.332.1-r0 |
jenkinsAlpine:v3.17 |
before 2.319.2-r0 | 2.319.2-r02.332.1-r0 |
jenkinsAlpine:v3.18 |
before 2.319.2-r0 | 2.319.2-r02.332.1-r0 |
jenkinsAlpine:v3.19 |
before 2.319.2-r0 | 2.319.2-r02.332.1-r0 |
Show 38 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jenkinsAlpine:v3.20 |
before 2.319.2-r0 | 2.319.2-r02.332.1-r0 |
jenkinsAlpine:v3.21 |
before 2.319.2-r0 | 2.319.2-r02.332.1-r0 |
jenkinsAlpine:v3.22 |
before 2.319.2-r0 | 2.319.2-r02.332.1-r0 |
jenkinsAlpine:v3.23 |
before 2.319.2-r0 | 2.319.2-r02.332.1-r0 |
jenkinsAlpine:v3.24 |
before 2.319.2-r0 | 2.319.2-r02.332.1-r0 |
jenkinsBitnami |
before 2.329.1 | 2.329.1 |
org.jenkins-ci.main:jenkins-coreMaven |
2.320 up to 2.330, plus listed versions 2.3212.3222.3232.3242.325 Show 4 moreShow less2.3262.3272.3282.329 |
2.330 |
org.jenkins-ci.main:jenkins-coreMaven |
before 2.319.2, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 |
2.319.2 |
jenkinsRed Hat:openshift:4.10::el8 |
before 0:2.319.2.1643288987-1.el8 | 0:2.319.2.1643288987-1.el8 |
coreos-installerRed Hat:openshift:4.10::el8 |
before 0:0.12.0-1.rhaos4.10.el8 | 0:0.12.0-1.rhaos4.10.el8 |
coreos-installer-bootinfraRed Hat:openshift:4.10::el8 |
before 0:0.12.0-1.rhaos4.10.el8 | 0:0.12.0-1.rhaos4.10.el8 |
coreos-installer-bootinfra-debuginfoRed Hat:openshift:4.10::el8 |
before 0:0.12.0-1.rhaos4.10.el8 | 0:0.12.0-1.rhaos4.10.el8 |
coreos-installer-debuginfoRed Hat:openshift:4.10::el8 |
before 0:0.12.0-1.rhaos4.10.el8 | 0:0.12.0-1.rhaos4.10.el8 |
coreos-installer-debugsourceRed Hat:openshift:4.10::el8 |
before 0:0.12.0-1.rhaos4.10.el8 | 0:0.12.0-1.rhaos4.10.el8 |
jenkins-2-pluginsRed Hat:openshift:4.10::el8 |
before 0:4.10.1643404185-1.el8 | 0:4.10.1643404185-1.el8 |
cri-oRed Hat:openshift:4.10::el7 |
before 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 | 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 |
cri-o-debuginfoRed Hat:openshift:4.10::el7 |
before 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 | 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 |
cri-oRed Hat:openshift:4.10::el8 |
before 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
cri-o-debuginfoRed Hat:openshift:4.10::el8 |
before 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
cri-o-debugsourceRed Hat:openshift:4.10::el8 |
before 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
openshiftRed Hat:openshift:4.10::el7 |
before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 |
openshift-clientsRed Hat:openshift:4.10::el7 |
before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 |
openshift-clients-redistributableRed Hat:openshift:4.10::el7 |
before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 |
openshift-hyperkubeRed Hat:openshift:4.10::el7 |
before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 |
openshiftRed Hat:openshift:4.10::el8 |
before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 |
openshift-clientsRed Hat:openshift:4.10::el8 |
before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 |
openshift-clients-redistributableRed Hat:openshift:4.10::el8 |
before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 |
openshift-hyperkubeRed Hat:openshift:4.10::el8 |
before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 |
jenkinsRed Hat:openshift:4.9::el8 |
before 0:2.319.2.1643391771-1.el8 | 0:2.319.2.1643391771-1.el8 |
jenkins-2-pluginsRed Hat:openshift:4.9::el8 |
before 0:4.9.1643389956-1.el8 | 0:4.9.1643389956-1.el8 |
jenkinsRed Hat:openshift:4.8::el8 |
before 0:2.319.2.1643648617-1.el8 | 0:2.319.2.1643648617-1.el8 |
jenkins-2-pluginsRed Hat:openshift:4.8::el8 |
before 0:4.8.1643649345-1.el8 | 0:4.8.1643649345-1.el8 |
jenkinsRed Hat:openshift:4.7::el8 |
before 0:2.319.2.1643882372-1.el8 | 0:2.319.2.1643882372-1.el8 |
jenkins-2-pluginsRed Hat:openshift:4.7::el8 |
before 0:4.7.1643883495-1.el8 | 0:4.7.1643883495-1.el8 |
jenkinsRed Hat:openshift:3.11::el7 |
before 0:2.319.2.1644411558-1.el7 | 0:2.319.2.1644411558-1.el7 |
jenkins-2-pluginsRed Hat:openshift:3.11::el7 |
before 0:3.11.1644412543-1.el7 | 0:3.11.1644412543-1.el7 |
jenkinsRed Hat:openshift:4.6::el8 |
before 0:2.319.2.1643964085-1.el8 | 0:2.319.2.1643964085-1.el8 |
jenkins-2-pluginsRed Hat:openshift:4.6::el8 |
before 0:4.6.1643965689-1.el8 | 0:4.6.1643965689-1.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-20612 is a medium vulnerability (CVSS 4.3) in Jenkins, published January 12, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.81%, the 78th percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.319.2.
References
jenkins.io/security/advisory/2022-01-12
openwall.com/lists/oss-security/2022/01/12/6
oracle.com/security-alerts/cpuapr2022.html
nvd.nist.gov/vuln/detail/CVE-2022-20612
Show 124 moreShow less
github.com/jenkinsci/jenkins/commit/b5c3764681f3b4ce83d0e78f6a9327925640d57e
security.alpinelinux.org/vuln/CVE-2022-20612
access.redhat.com/errata/RHSA-2022:0055
bugzilla.redhat.com/show_bug.cgi?id=1129074
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0055.json
cve.org/CVERecord?id=CVE-2014-3577
groups.google.com/g/golang-announce/c/0fM21h43arc
kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster
This page doesn't list everything
Left out here: 675 versions. The JSON record has them.