CVE-2022-36883

A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.

• CWE-862

• http://www.openwall.com/lists/oss-security/2022/07/27/1Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/07/27/1Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284Vendor Advisory

Published

Jul 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36878Exposure of Sensitive Information in Find My Mobile prior to…3.3
• CVE-2022-36879An issue was discovered in the Linux kernel through 5.18.14.…5.5
• CVE-2022-3688The WPQA Builder WordPress plugin before 5.9 does not have C…8.8
• CVE-2022-36880The Read Mail module in Webmin 1.995 and Usermin through 1.8…6.1
• CVE-2022-36881Jenkins Git client Plugin 3.11.0 and earlier does not perfor…8.1
• CVE-2022-36882A cross-site request forgery (CSRF) vulnerability in Jenkins…8.8
• CVE-2022-36884The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlie…5.3
• CVE-2022-36885Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant…5.3
• CVE-2022-36886A cross-site request forgery (CSRF) vulnerability in Jenkins…4.3
• CVE-2022-36887A cross-site request forgery (CSRF) vulnerability in Jenkins…4.3
• CVE-2022-36888A missing permission check in Jenkins HashiCorp Vault Plugin…6.5
• CVE-2022-36889Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earli…8.8