Cross site request forgery in Jenkins Job and Node ownership Plugin

2022-03-3000:00:23

Google

osv.dev

0.001 Low

EPSS

Percentile

34.5%

JSON

Job and Node ownership Plugin 0.13.0 and earlier does not perform a permission check in several HTTP endpoints. This allows attackers with Item/Read permission to change the owners and item-specific permissions of a job. Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

CPENameOperatorVersion
com.synopsys.jenkinsci:ownershipeq0.9.0
com.synopsys.jenkinsci:ownershipeq0.1.0
com.synopsys.jenkinsci:ownershipeq0.12.1
com.synopsys.jenkinsci:ownershipeq0.3
com.synopsys.jenkinsci:ownershipeq0.10.0
com.synopsys.jenkinsci:ownershipeq0.9.0-beta-1
com.synopsys.jenkinsci:ownershipeq0.2.1
com.synopsys.jenkinsci:ownershipeq0.4
com.synopsys.jenkinsci:ownershipeq0.12.0
com.synopsys.jenkinsci:ownershipeq0.5

Name	Operator	Version
com.synopsys.jenkinsci:ownership	eq	0.9.0
com.synopsys.jenkinsci:ownership	eq	0.1.0
com.synopsys.jenkinsci:ownership	eq	0.12.1
com.synopsys.jenkinsci:ownership	eq	0.3
com.synopsys.jenkinsci:ownership	eq	0.10.0
com.synopsys.jenkinsci:ownership	eq	0.9.0-beta-1
com.synopsys.jenkinsci:ownership	eq	0.2.1
com.synopsys.jenkinsci:ownership	eq	0.4
com.synopsys.jenkinsci:ownership	eq	0.12.0
com.synopsys.jenkinsci:ownership	eq	0.5