CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2022-34180
High (7.5) in jenkins embeddable build status. EPSS 1.3% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.plugins:embeddable-build-status 2.0.4.
Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotected" status badge access, allowing attackers without any permissions to obtain the build status badge icon for any attacker-specified job and/or build.
Severity
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:embeddable_build_status
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xxhf-xq6v-c8mj | Maven | org.jenkins-ci.plugins:embeddable-build-status | <2.0.4 | 2.0.4 |