PT-2022-18836 · Jenkins · Jenkins Rocketchat Notifier Plugin+1

Marc Heyries · Published 2022-03-29 · Updated 2023-11-17 · CVE-2022-28138

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins RocketChat Notifier Plugin versions 1.4.10 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials. This issue arises because the plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to exploit the vulnerability. Furthermore, the form validation method does not require POST requests, contributing to the CSRF vulnerability.

Recommendations For Jenkins RocketChat Notifier Plugin versions 1.4.10 and earlier, update to version 1.5.0, which requires POST requests and Overall/Administer permission for the affected form validation method, thus mitigating the issue. As a temporary workaround, consider restricting access to the form validation method to users with Overall/Administer permission until the update to version 1.5.0 is applied.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-28138

GHSA-X25H-F84X-WH4M

Affected Products

Jenkins

Jenkins Rocketchat Notifier Plugin

References · 8

• https://jenkins.io/security/advisory/2022-03-29/#SECURITY-2241 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x25h-f84x-wh4m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28138 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28138 · Vendor Advisory
• https://github.com/jenkinsci/rocketchatnotifier-plugin · Note
• http://openwall.com/lists/oss-security/2022/03/29/1 · Note
• https://t.me/cibsecurity/39725 · Telegram Post
• https://t.me/cvenotify/60601 · Telegram Post