Cross Site Request Forgery in Jenkins Blue Ocean Plugin

MITTEL 6.5CVE-2022-30953 · GHSA-hgpq-42pf-9vfq · Published 17/05/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-30953 ist eine Schwachstelle (MITTEL (CVSS 6.5)) in io.jenkins.blueocean:blueocean-parent, blue ocean (jenkins).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.73%, höher als bei 54.2% aller Schwachstellen.
Abhilfe: auf 1.25.4 oder neuer aktualisieren.

Package	Affected versions	Patched versions
io.jenkins.blueocean:blueocean-parent Maven	`< 1.25.4`	`1.25.4`
blue ocean jenkins	`≤ 1.25.3`	No fix yet

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server. Blue Ocean Plugin 1.25.4 requires POST requests and the appropriate permissions for the affected HTTP endpoints.

NVD description

A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.

References

nvd.nist.gov/vuln/detail/CVE-2022-30953 · ADVISORY
jenkinsci/blueocean-plugin commit 9f44b89 · WEB
jenkinsci/blueocean-plugin · PACKAGE
jenkins.io/security/advisory/2022-05-17 · WEB
openwall.com/lists/oss-security/2022/05/17/8 · WEB

Weitere Schwachstellen in io.jenkins.blueocean:blueocean-parent

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

io.jenkins.blueocean:blueocean-parent

Maven

< 1.25.4

1.25.4

blue ocean

jenkins

≤ 1.25.3

No fix yet

Description

NVD description

A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.