CVE-2022-28150: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to change the owners and item-specific permissions of a job.
Other sources
Job and Node ownership Plugin 0.13.0 and earlier does not perform a permission check in several HTTP endpoints. This allows attackers with Item/Read permission to change the owners and item-specific permissions of a job. Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-28150?
CVE-2022-28150 has been classified as a high severity vulnerability due to its potential impact on job permissions.
How do I fix CVE-2022-28150?
To fix CVE-2022-28150, update the Jenkins Job and Node Ownership Plugin to version 0.14.0 or later.
What attack vector does CVE-2022-28150 utilize?
CVE-2022-28150 utilizes a cross-site request forgery (CSRF) attack vector to exploit job ownership changes.
What software is affected by CVE-2022-28150?
CVE-2022-28150 affects Jenkins Job and Node Ownership Plugin versions 0.13.0 and earlier.
What can attackers achieve with CVE-2022-28150?
Attackers can change job ownership and item-specific permissions, potentially leading to unauthorized access.