PT-2022-20408 · Jenkins · Jenkins Blue Ocean Plugin+1

Tanner Emek · Published 2022-05-17 · Updated 2023-11-03 · CVE-2022-30953

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Blue Ocean Plugin versions 1.25.3 and earlier

Description A cross-site request forgery (CSRF) issue allows attackers to connect to an attacker-specified HTTP server. The vulnerability can be exploited by making the victim's browser send an unintended request to the affected HTTP endpoints. In the fixed version, Blue Ocean Plugin 1.25.4, the vulnerability is mitigated by requiring POST requests and the appropriate permissions for the affected endpoints.

Recommendations For Jenkins Blue Ocean Plugin versions 1.25.3 and earlier, update to version 1.25.4 or later, which requires POST requests and the appropriate permissions for the affected HTTP endpoints, thus mitigating the CSRF issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-30953

GHSA-HGPQ-42PF-9VFQ

RHSA-2023:0017

RHSA-2023:0560

RHSA-2023:0777

RHSA-2023:3198

RHSA-2023:3610

RHSA-2023:3622

Affected Products

Jenkins

Jenkins Blue Ocean Plugin

References · 7

• https://jenkins.io/security/advisory/2022-05-17/#SECURITY-2502 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30953 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30953 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hgpq-42pf-9vfq · Vendor Advisory
• https://github.com/jenkinsci/blueocean-plugin/commit/9f44b895d018c514d5dccc1f2190a2a029e58259 · Note
• https://github.com/jenkinsci/blueocean-plugin · Note
• http://openwall.com/lists/oss-security/2022/05/17/8 · Note