CVE-2022-43408

State: Published
Severity: 6.5 Medium
Published: Oct 19, 2022
Updated: May 8, 2025
Reserved: Oct 18, 2022

Description

Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proceed or abort Pipeline builds, allowing attackers able to configure Pipelines to specify 'input' step IDs resulting in URLs that would bypass the CSRF protection of any target URL in Jenkins.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N	CISA-ADP

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
Jenkins Pipeline: Stage View PluginJenkins project	2.24.2Not affected 2.26 and earlierAffected

References

https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2828
[oss-security] 20221019 Multiple vulnerabilities in Jenkins pluginsmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.