Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-34789

CVE-2022-34789: Jenkins Matrix Reloaded Plugin vulnerable to CSRF

6.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-34789
GHSA ID
GHSA-4v5c-5v6c-37pj
EPSS Score
0.2542%
CWE
CWE-352
Published
7/1/2022
Updated
2/2/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
net.praqma:matrix-reloadedmaven<= 1.1.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from an HTTP endpoint accepting rebuild requests without POST method enforcement. In Jenkins plugin architecture, such endpoints typically correspond to 'do*' methods in Action classes. The advisory explicitly states the lack of POST requirement, which maps to missing @RequirePOST annotation and CSRF protection in the rebuild handler. While exact code isn't available, this pattern matches Jenkins' vulnerability patterns for CSRF (CWE-352) and the plugin's described functionality.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins M*trix R*lo**** Plu*in *.*.* *n* **rli*r *o*s not r*quir* POST r*qu*sts *or *n *TTP *n*point, r*sultin* in * *ross-sit* r*qu*st *or**ry (*SR*) vuln*r**ility. T*is vuln*r**ility *llows *tt**k*rs to r**uil* pr*vious m*trix *uil*s.

Reasoning

T** vuln*r**ility st*ms *rom *n `*TTP` *n*point ****ptin* r**uil* r*qu*sts wit*out `POST` m*t*o* *n*or**m*nt. In `J*nkins` plu*in *r**it**tur*, su** *n*points typi**lly *orr*spon* to '*o*' m*t*o*s in `**tion` *l*ss*s. T** **visory *xpli*itly st*t*s t