CVE-2022-43407 - CVE House
Back to Database
Status published Unknown CVE-2022-43407

Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not...

Vulnerability Description

Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is used for the URLs that process user interactions for the given 'input' step (proceed or abort) and is not correctly encoded, allowing attackers able to configure Pipelines to have Jenkins build URLs from 'input' step IDs that would bypass the CSRF protection of any target URL in Jenkins when the 'input' step is interacted with.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-43407

Credits & Attribution

No credits recorded in the NVD database.

References

More from Jenkins project

View All →
CVE-2022-45401
Jenkins Associated Files Plugin 0.2.1 and earlier does not escape...
Unknown 0
CVE-2022-45400
Jenkins JAPEX Plugin 1.7 and earlier does not configure its...
Unknown 0
CVE-2022-45399
A missing permission check in Jenkins Cluster Statistics Plugin 0.4.6...
Unknown 0
CVE-2022-45398
A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics...
Unknown 0
CVE-2022-45397
Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2...
Unknown 0

Affected Vendor

Jenkins project

View all reports →

Affected Software

Jenkins Pipeline: Input Step Plugin
Vulnerable Versions:
449.451.v9c3d42f23975, unspecified

Timeline

Official Publish: October 19th, 2022
Last Modified: May 8th, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.