PT-2022-18851 · Jenkins · Jenkins Job/Node Ownership Plugin+1

Daniel Beck · CVE-2022-28152 · Published 2022-03-29 · Updated 2023-11-03

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Job and Node ownership Plugin versions 0.13.0 and earlier

Description A cross-site request forgery (CSRF) issue allows attackers to restore the default ownership of a job. This can be exploited by attackers to potentially gain unauthorized access or control over jobs.

Recommendations For Jenkins Job and Node ownership Plugin versions 0.13.0 and earlier, consider disabling the restore default ownership feature until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-28152

GHSA-9HCJ-449V-9234

Affected Products

Jenkins

Jenkins Job/Node Ownership Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-28152 · Security Note
• https://osv.dev/vulnerability/GHSA-9hcj-449v-9234 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-03-29/#SECURITY-2062%20%282%29 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28152 · Vendor Advisory
• https://github.com/jenkinsci/ownership-plugin · Note
• https://t.me/cibsecurity/39730 · Telegram Post
• http://openwall.com/lists/oss-security/2022/03/29/1 · Note
• https://jenkins.io/security/advisory/2022-03-29/#SECURITY-2062%20(2) · Note