{"id":"CVE-2022-20613","published":"2022-01-12T00:00:00Z","modified":"2024-08-03T02:17:52Z","title":"A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows…","vendor":"Jenkins","product":"Jenkins Mailer Plugin","tier":"tail","description":{"text":"A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00957,"percentile":0.61462,"provenance":"source"},"cwes":[],"references":[{"url":"https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2163","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2022/01/12/6","tags":["mailing-list"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":[]}],"priority":{"score":12.3,"factors":[{"name":"EPSS percentile","points":12.29}]},"vendorSlug":"jenkins","affectedVersions":[{"vendor":"Jenkins project","product":"Jenkins Mailer Plugin","versions":[">= unspecified, <= 391.ve4a_38c1b_cf4b_"]}],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:mailer","vulnerableRanges":[">=391.ve4a38c1bcf4b, <408.vd726a","<1.34.2"],"patched":["408.vd726a","1.34.2"],"from":["GHSA-85rq-hp8x-ghjq"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0518","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2017-2651","published":"2018-07-27","fixed":"1.20","kev":false},{"cve":"CVE-2018-8718","published":"2018-03-27","fixed":"1.21","kev":false},{"cve":"CVE-2020-2252","published":"2020-09-16","fixed":"1.32.1","kev":false,"link":{"from":"CVE-2020-2252","to":"CVE-2022-20613","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:mailer","fromFixed":"1.32.1","toFixed":"1.34.2","daysApart":483},{"kind":"similar","provenance":"machine","score":0.44,"basis":"same product + description similarity"}]}},{"cve":"CVE-2022-20613","published":"2022-01-12","fixed":"408.vd726a","kev":false},{"cve":"CVE-2022-20614","published":"2022-01-12","fixed":"408.vd726a","kev":false}],"package":"Maven:org.jenkins-ci.plugins:mailer"}}