CVE-2022-30954 Missing permission check in Jenkins Blue Ocean Plugin

What is CVE-2022-30954?

CVE-2022-30954 is a medium-severity missing authorization vulnerability in Jenkins Blue Ocean Plugin, published on 17 May 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server.

Weakness: CWE-862

Which versions are affected by CVE-2022-30954?

2 open source packages ship an affected version, including io.jenkins.blueocean:blueocean-parent. It affects 1 product.

Products include Jenkins Blue Ocean.

How do I fix CVE-2022-30954?

Upgrade io.jenkins.blueocean:blueocean-parent to 1.25.4 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-30954 being exploited?

There is no known exploitation of CVE-2022-30954 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Blue Ocean Plugin

• CVE-2023-40341 Jenkins Blue Ocean Plugin cross-site request forgery vulnerability High 8.8
• CVE-2017-1000106 Improper Authentication in Jenkins Blue Ocean Plugin High 8.5
• CVE-2022-30952 Insufficiently Protected Credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin Medium 6.5
• CVE-2022-30953 Cross Site Request Forgery in Jenkins Blue Ocean Plugin Medium 6.5
• CVE-2020-2254 Path traversal vulnerability in Blue Ocean Plugin Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5m4q-x28v-q6wp.