Read the docs
TI-2022-10320 Aliases CVE-2022-27198GHSA-pv4m-7c68-f4c5

Cross-site request forgery in Jenkins CloudBees AWS Credentials Plugin

Priority LOW 35CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.

Why it matters now

EPSS 0.00511 43rd percentileScored 2026-11-07
Fix Fixed Jenkins CloudBees AWS Credentials Plugin (Jenkins project): 1.28.2, 1.32.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins CloudBees AWS Credentials Pluginup to 189.v3551d56429951.28.2, 1.32.1Patch availableCNA
—org.jenkins-ci.plugins:aws-credentials (Maven)up to 189.v3551d5642995—No fix listedGHSA-pv4m-7c68-f4c5
  • Jenkins CloudBees AWS Credentials Plugin VendorJenkins Affected up to 189.v3551d5642995 Fixed in 1.28.2, 1.32.1 Patch available CNA
  • org.jenkins-ci.plugins:aws-credentials (Maven) Vendor— Affected up to 189.v3551d5642995 Fixed in — No fix listed GHSA-pv4m-7c68-f4c5

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:cloudbees_aws_credentials:*:*:*:*:*:jenkins:*:*up to 189.v3551d5642995; 1.28 to before 1.28.2VulnerableJenkins
cpe:2.3:a:jenkins:cloudbees_aws_credentials:1.32:*:*:*:*:jenkins:*:*1.32VulnerableJenkins
  • cpe:2.3:a:jenkins:cloudbees_aws_credentials:*:*:*:*:*:jenkins:*:* Versions up to 189.v3551d5642995; 1.28 to before 1.28.2 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:cloudbees_aws_credentials:1.32:*:*:*:*:jenkins:*:* Versions 1.32 Vulnerable ·Jenkins

Remediation

  • Fix · CNA Jenkins CloudBees AWS Credentials Plugin (Jenkins project) Fixed in 1.28.2, 1.32.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-27198
  2. 2026-10-03 Alias added: GHSA-pv4m-7c68-f4c5

References

Advisory 3

Other 2

  • TI-2022-10321 Missing authorization in Jenkins CloudBees AWS Credentials Plugin CVSS 3.1MEDIUM 4.3
  • TI-2021-04705 Missing authorization in Jenkins CloudBees AWS Credentials Plugin CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences