CVE-2022-28149 — Stored Cross-site Scripting vulnerability in Jenkins Job and Node ownership Plug

Description

Jenkins Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of the secondary owners, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

How to fix CVE-2022-28149

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

—no fix listed

Is CVE-2022-28149 being exploited?

Low — EPSS is 0.8%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

from 0, <= 0.13.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.0	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References (4)

ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-28149
PATCHgithub.com/jenkinsci/ownership-plugin
WEBwww.openwall.com/lists/oss-security/2022/03/29/1
WEBwww.jenkins.io/security/advisory/2022-03-29/#SECURITY-2285