TI-2022-08905 Aliases CVE-2022-25192 GHSA-fhfh-6cjg-57rg

Cross-site request forgery in Jenkins Snow Commander Plugin

LOW 39CWE-352Published 2022-02-15 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins Snow Commander Plugin 1.10 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Why it matters now

EPSS 0.00655 51st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jenkins	Jenkins Snow Commander Plugin	up to 1.10	—	No fix listed	CNA
—	io.jenkins.plugins:embotics-vcommander (Maven)	all versions	—	No fix listed	GHSA-fhfh-6cjg-57rg

Jenkins Snow Commander Plugin VendorJenkins Affected up to 1.10 Fixed in — No fix listed CNA
io.jenkins.plugins:embotics-vcommander (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-fhfh-6cjg-57rg

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:snow_commander::::::jenkins::*	up to 1.10	Vulnerable	Jenkins

cpe:2.3:a:jenkins:snow_commander:*:*:*:*:*:jenkins:*:* Versions up to 1.10 Vulnerable ·Jenkins

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-25192
2026-10-03 Alias added: GHSA-fhfh-6cjg-57rg
2026-10-13 EPSS moved to the 50th–90th percentile

References

Patch 1

https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2536

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-25192

Other 2

TI-2022-08906 Missing authorization in Jenkins Snow Commander Plugin CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences