Cross Site Request Forgery in Jenkins Blue Ocean Plugin

中危 6.5CVE-2022-30953 · GHSA-hgpq-42pf-9vfq · Published 17/05/2022 · updated 17/06/2026

要点

CVE-2022-30953 是影响 io.jenkins.blueocean:blueocean-parent, blue ocean (jenkins) 的中危 (CVSS 6.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.73%，高于 54.2% 的漏洞。
修复：升级到 1.25.4 或更高版本。

Package	Affected versions	Patched versions
io.jenkins.blueocean:blueocean-parent Maven	`< 1.25.4`	`1.25.4`
blue ocean jenkins	`≤ 1.25.3`	No fix yet

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server. Blue Ocean Plugin 1.25.4 requires POST requests and the appropriate permissions for the affected HTTP endpoints.

NVD description

A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.

References

nvd.nist.gov/vuln/detail/CVE-2022-30953 · ADVISORY
jenkinsci/blueocean-plugin commit 9f44b89 · WEB
jenkinsci/blueocean-plugin · PACKAGE
jenkins.io/security/advisory/2022-05-17 · WEB
openwall.com/lists/oss-security/2022/05/17/8 · WEB

io.jenkins.blueocean:blueocean-parent 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

io.jenkins.blueocean:blueocean-parent

Maven

< 1.25.4

1.25.4

blue ocean

jenkins

≤ 1.25.3

No fix yet

Description

NVD description

A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.