Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2022-36883

38
FAUCET Score

CVE-2022-36883 is a critical missing permission check vulnerability in Jenkins Git Plugin versions 4.11.3 and earlier. This flaw allows unauthenticated attackers to trigger builds and check out arbitrary commits from attacker-specified Git repositories. With a CVSS score of 7.5 (High) and an EPSS score indicating high exploitability, the vulnerability poses a significant risk of unauthorized code execution. While not currently on the KEV list or actively exploited, a Nuclei template exists, and its high FAUCET Risk Score suggests a strong potential for future exploitation.

Impacted Technologies

VendorProductVersion(s)CPE
<= 4.11.3CPE matchmatch criteria
cpe:2.3:a:jenkins:git:*:*:*:*:*:jenkins:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
5.56%
Probability of exploitation in next 30 days
EPSS Percentile
92.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-24
Model: v2026.06.15
Nuclei: CVE-2022-36883 · Aug 9, 2022
This CVE's current EPSS score of 0.0556 is in the 86th percentile among its peer group of 51,455 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (6)

mavenpatch availablevia ghsa
Product: org.jenkins-ci.plugins:gitFixed in: 4.11.4
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.10Fixed in: jenkins-2-plugins-0:4.10.1675144701-1.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.8Fixed in: jenkins-2-plugins-0:4.8.1672842762-1.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.9Fixed in: jenkins-2-plugins-0:4.9.1675668922-1.el8
View patch
jenkinsvendor investigatingvia nvd_reference
View patch
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Container Platform 3.11Fixed in: jenkins-2-plugins

Vendor Advisories (2)

mavenGHSA-v878-67xw-grw2medium

Lack of authentication mechanism in Jenkins Git Plugin webhook

Jul 28, 2022
redhatCVE-2022-36883Moderate

plugin: Lack of authentication mechanism in Git Plugin webhook

Jul 27, 2022

References

jenkins.io / security/advisory/2022-07-27
Vendor Advisory
openwall.com / lists/oss-security/2022/07/27/1
Mailing ListThird Party Advisory