CVE-2022-28152: CSRF vulnerability in Jenkins Job and Node ownership Plugin
Summary
CVE-2022-28152: CSRF vulnerability in Jenkins Job and Node ownership Plugin. Affects com.synopsys.jenkinsci:ownership versions < 0.13.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Job and Node ownership Plugin is a Maven package (com.synopsys.jenkinsci:ownership) that provides functionality for managing ownership of jobs and nodes in the Jenkins automation server. It allows users to assign ownership of jobs and nodes to specific individuals or groups, enabling better collaboration and access control. However, versions 0.13.0 and earlier of the plugin are vulnerable to a cross-site request forgery (CSRF) attack.
Vulnerability Detail
The CSRF vulnerability in the Jenkins Job and Node ownership Plugin allows attackers to perform unauthorized actions on behalf of authenticated users. By tricking a user into visiting a malicious website or clicking on a specially crafted link, an attacker can exploit this vulnerability to restore the default ownership of a job. This can lead to unauthorized access, data loss, or disruption of the Jenkins server.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by upgrading to a non-vulnerable version of the plugin.
Conclusion
The CSRF vulnerability in the Jenkins Job and Node ownership Plugin (CVE-2022-28152) poses a moderate risk to Jenkins installations. It allows attackers to restore the default ownership of a job, potentially leading to unauthorized access, data loss, or disruption of the Jenkins server. To mitigate this vulnerability, it is recommended to upgrade to a non-vulnerable version of the plugin. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.synopsys.jenkinsci:ownership →
FAQ
This vulnerability allows attackers to restore the default ownership of a job in Jenkins, potentially leading to unauthorized access, data loss, or disruption of the Jenkins server.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this CSRF vulnerability.
At the time of writing, there are no known public exploits for this vulnerability. However, it is crucial to apply the fix promptly to mitigate the risk of potential attacks.
No, upgrading to a non-vulnerable version of the plugin is the recommended solution. There is no known workaround for this vulnerability.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-9hcj-449v-9234/GHSA-9hcj-449v-9234.json).
Related vulnerabilities
Recent vulnerabilities recorded for com.synopsys.jenkinsci:ownership.
