CVE-2022-25206

Description

A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified database via JDBC using attacker-specified credentials.

How to fix CVE-2022-25206

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• —no fix listed

Is CVE-2022-25206 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, <= 0.5.2

CVSS scores

References (3)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-25206
• PATCHgithub.com/jenkinsci/dbCharts-plugin
• WEBwww.jenkins.io/security/advisory/2022-02-15/#SECURITY-2177