PT-2022-20409 · Jenkins · Jenkins Blue Ocean Plugin+1

Wadeck Follonier · Published 2022-05-17 · Updated 2023-11-03 · CVE-2022-30954

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Blue Ocean Plugin versions 1.25.3 and earlier

Description The issue allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server due to a lack of permission checks in several HTTP endpoints.

Recommendations For Jenkins Blue Ocean Plugin versions 1.25.3 and earlier, update to version 1.25.4 or later, which requires POST requests and the appropriate permissions for the affected HTTP endpoints.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-30954

GHSA-5M4Q-X28V-Q6WP

RHSA-2023:0017

RHSA-2023:0560

RHSA-2023:0777

RHSA-2023:3198

RHSA-2023:3610

RHSA-2023:3622

Affected Products

Jenkins

Jenkins Blue Ocean Plugin

References · 8

• https://osv.dev/vulnerability/GHSA-5m4q-x28v-q6wp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30954 · Security Note
• https://jenkins.io/security/advisory/2022-05-17/#SECURITY-2502 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30954 · Vendor Advisory
• https://github.com/jenkinsci/blueocean-plugin · Note
• https://github.com/jenkinsci/blueocean-plugin/commit/ffd89b675b172c86613459935fe220dc2bba0c57 · Note
• http://openwall.com/lists/oss-security/2022/05/17/8 · Note
• https://t.me/cibsecurity/42817 · Telegram Post