CVE-2022-28150: Cross-Site Request Forgery in Jenkins Job and Node Ownership Plugin
Summary
CVE-2022-28150: Cross site request forgery in Jenkins Job and Node ownership Plugin. Affects com.synopsys.jenkinsci:ownership versions < 0.13.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Job and Node Ownership Plugin is a Maven package (com.synopsys.jenkinsci:ownership) that provides functionality for managing ownership and permissions of jobs and nodes in the Jenkins automation server. It allows administrators to assign owners to specific jobs and nodes, as well as define item-specific permissions. This plugin is widely used in Jenkins environments to ensure proper access control and ownership management.
Vulnerability Detail
The Job and Node Ownership Plugin version 0.13.0 and earlier is affected by a cross-site request forgery (CSRF) vulnerability. This vulnerability arises from the plugin's failure to perform a permission check in several HTTP endpoints. As a result, attackers with Item/Read permission can exploit this vulnerability to modify the owners and item-specific permissions of a job. Additionally, the affected endpoint does not require POST requests, further facilitating CSRF attacks. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the affected HTTP endpoints by configuring network-level access controls or firewall rules. This prevents external access to the vulnerable endpoints and reduces the risk of CSRF attacks. However, this workaround may limit the functionality of the Job and Node Ownership Plugin, so upgrading to the fixed version is still the recommended solution.
Conclusion
The Job and Node Ownership Plugin version 0.13.0 and earlier is vulnerable to a cross-site request forgery (CSRF) attack, allowing attackers with Item/Read permission to modify job ownership and item-specific permissions. To address this vulnerability, it is recommended to upgrade to version 0.14.0 or later. In the meantime, users can implement network-level access controls or firewall rules to limit external access to the affected endpoints. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.synopsys.jenkinsci:ownership →
FAQ
The vulnerability allows attackers with Item/Read permission to modify job ownership and item-specific permissions. This can lead to unauthorized access, data manipulation, or disruption of Jenkins automation processes.
No, authentication is not required. The vulnerability can be exploited through cross-site request forgery (CSRF) attacks, which do not rely on authentication.
No, only versions 0.13.0 and earlier are affected. The vulnerability has been addressed in version 0.14.0 and later.
Yes, this vulnerability can be exploited remotely. Attackers can craft malicious requests and trick authenticated users into executing them, leading to unauthorized modifications.
At the time of this report, there are no known public exploits targeting this vulnerability. However, it is crucial to apply the recommended fixes to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for com.synopsys.jenkinsci:ownership.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
