CVE-2022-28139

描述

Jenkins RocketChat Notifier Plugin 1.4.10 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. RocketChat Notifier Plugin 1.5.0 requires POST requests and Overall/Administer permission for the affected form validation method.

受影響套件(1)

• Maven/org.jenkins-ci.plugins:rocketchatnotifierfrom 0, < 1.5.0

CVSS 分數

參考連結(5)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-28139
• PATCHhttps://github.com/jenkinsci/rocketchatnotifier-plugin
• WEBhttps://github.com/jenkinsci/rocketchatnotifier-plugin/commit/1a0023be9f2e143434d028d5292ef9dc3195d051
• WEBhttps://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2241
• WEBhttp://www.openwall.com/lists/oss-security/2022/03/29/1