CVE-2022-28149: Stored Cross-site Scripting in Jenkins Job and Node ownership Plugin
Summary
CVE-2022-28149: Stored Cross-site Scripting vulnerability in Jenkins Job and Node ownership Plugin. Affects com.synopsys.jenkinsci:ownership versions < 0.13.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Job and Node ownership Plugin is a Maven package (com.synopsys.jenkinsci:ownership) that provides functionality for managing ownership of Jenkins jobs and nodes. It allows users to assign primary and secondary owners to jobs and nodes, enabling better collaboration and access control. However, versions 0.13.0 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in the Jenkins Job and Node ownership Plugin arises from the lack of proper escaping of the names of secondary owners. This allows attackers with Item/Configure permission to inject malicious scripts into the plugin's interface, which can then be executed by unsuspecting users. The impact of this vulnerability can range from unauthorized access to sensitive information to complete control over the affected Jenkins instance. The vulnerability has a CVSS score of 8.0, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to the latest version of the plugin is not immediately feasible, a temporary workaround is to restrict Item/Configure permission to trusted users only. By limiting access to the configuration of jobs and nodes, the risk of exploitation can be mitigated. However, this is not a permanent solution, and it is strongly advised to apply the official fix by updating the plugin as soon as possible.
Conclusion
The Jenkins Job and Node ownership Plugin versions 0.13.0 and earlier are vulnerable to a stored cross-site scripting (XSS) attack. This can lead to unauthorized access, data theft, or complete control over the affected Jenkins instance. It is crucial to update the plugin to version 0.14.0 or later to mitigate the vulnerability. If immediate upgrading is not possible, restricting Item/Configure permission to trusted users can provide temporary protection. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.synopsys.jenkinsci:ownership →
FAQ
The vulnerability allows attackers to execute arbitrary scripts in the context of unsuspecting users, potentially leading to unauthorized access, data theft, or complete control over the affected Jenkins instance.
Users of Jenkins Job and Node ownership Plugin versions 0.13.0 and earlier are affected by this vulnerability.
Yes, the vulnerability can be fixed by upgrading to version 0.14.0 or later of the Jenkins Job and Node ownership Plugin.
A temporary workaround is to restrict Item/Configure permission to trusted users only. However, it is recommended to apply the official fix by updating the plugin.
For more information about this vulnerability, you can refer to the CVE-2022-28149 entry or contact the Jenkins community for assistance.
Related vulnerabilities
Recent vulnerabilities recorded for com.synopsys.jenkinsci:ownership.
