Read the docs
TI-2022-17102 Aliases CVE-2022-36887GHSA-j896-j72w-cr32

Cross-site request forgery in Jenkins Job Configuration History Plugin

Priority LOW 20CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier allows attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations.

Why it matters now

EPSS 0.00414 36th percentileScored 2026-11-07
Fix Fixed org.jenkins-ci.plugins:jobConfigHistory (Maven): 1156.v536a_97b_8d649

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Job Configuration History Pluginup to 1155.v28a_46a_cc06a_5—No fix listedCNA
—org.jenkins-ci.plugins:jobConfigHistory (Maven)before 1156.v536a_97b_8d6491156.v536a_97b_8d649Patch availableGHSA-j896-j72w-cr32
  • Jenkins Job Configuration History Plugin VendorJenkins Affected up to 1155.v28a_46a_cc06a_5 Fixed in — No fix listed CNA
  • org.jenkins-ci.plugins:jobConfigHistory (Maven) Vendor— Affected before 1156.v536a_97b_8d649 Fixed in 1156.v536a_97b_8d649 Patch available GHSA-j896-j72w-cr32

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:job_configuration_history:*:*:*:*:*:jenkins:*:*up to 1155.v28a_46a_cc06a_5VulnerableJenkins
  • cpe:2.3:a:jenkins:job_configuration_history:*:*:*:*:*:jenkins:*:* Versions up to 1155.v28a_46a_cc06a_5 Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-j896-j72w-cr32 org.jenkins-ci.plugins:jobConfigHistory (Maven) Fixed in 1156.v536a_97b_8d649 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-36887
  2. 2026-10-03 Alias added: GHSA-j896-j72w-cr32

References

Advisory 3

Other 1

  • TI-2023-22318 XML external entity injection in Jenkins Job Configuration History Plugin CVSS 3.1HIGH 8.8
  • TI-2023-22317 XML external entity injection in Jenkins Job Configuration History Plugin CVSS 3.1MEDIUM 6.5
  • TI-2022-18197 Cross-site scripting in Jenkins Job Configuration History Plugin CVSS 3.1MEDIUM 5.4
  • TI-2023-22316 Cross-site scripting in Jenkins Job Configuration History Plugin CVSS 3.1MEDIUM 5.4
  • TI-2023-22315 Path traversal in Jenkins Job Configuration History Plugin CVSS 3.1MEDIUM 4.3
  • TI-2026-41224 Cleartext storage of sensitive information in Jenkins Job Configuration History Plugin CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences