CVE-2022-41238: Jenkins Dotci

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

A missing permission check in Jenkins DotCi Plugin 2.40.00 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits.

Affected products

• Jenkins Dotci: up to and including 2.40.00

Published 2022-09-21. Last modified 2026-06-17.