CSRF Vulnerability in Jenkins RocketChat Notifier Plugin
CVE-2022-28138

4.3MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Rocketchat Notifier Plugin
Vendor
CVE Published:
29 March 2022

What is CVE-2022-28138?

A cross-site request forgery vulnerability in the Jenkins RocketChat Notifier Plugin allows attackers to forge requests that connect to an attacker-specified URL using credentials defined by the attacker. This poses a serious risk as it enables unauthorized actions executed within the user context, which can lead to further exploitation or compromise of sensitive information.

Affected Version(s)

Jenkins RocketChat Notifier Plugin <= 1.4.10

References

https://www.jenkins.io/security/advisory/2022-03-29/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2022/03/29/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.