CSRF Vulnerability in Jenkins Job and Node Ownership Plugin
CVE-2022-28150

8.8HIGH

Key Information:

Vendor

Jenkins
Status
Jenkins Job And Node Ownership Plugin
Vendor
CVE Published:
29 March 2022

What is CVE-2022-28150?

The Jenkins Job and Node Ownership Plugin is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability, which permits unauthorized attackers to change the ownership and specific permissions of a Jenkins job. If exploited, this vulnerability can enable an attacker to assume control over job configurations without authorization, potentially leading to further security breaches. It is crucial for users of the affected plugin version to apply necessary patches to safeguard against this risk.

Affected Version(s)

Jenkins Job and Node ownership Plugin <= 0.13.0

References

https://www.jenkins.io/security/advisory/2022-03-29/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2022/03/29/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.