CVE-2022-2062: 
JavaScript vulnerability analysis and mitigation

The Job and Node ownership Plugin for Jenkins version 0.13.0 and earlier contains multiple security vulnerabilities identified as SECURITY-2062. The vulnerabilities include a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2022-28150) and a missing permission check (CVE-2022-28151) that affect the plugin's HTTP endpoints (Jenkins Advisory).

The vulnerability allows attackers with Item/Read permission to change the owners and item-specific permissions of a job due to missing permission checks in several HTTP endpoints. Additionally, these endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. The CVSS severity is rated as Medium. The CSRF vulnerability is only exploitable in Jenkins 2.286 and earlier, LTS 2.277.1 and earlier (Jenkins Advisory).

Successful exploitation of these vulnerabilities could allow attackers to modify job ownership settings and item-specific permissions without proper authorization. This could lead to unauthorized access control changes and potential privilege escalation within affected Jenkins installations (Jenkins Advisory).

The vulnerabilities require an attacker to have Item/Read permission in the Jenkins instance. The CSRF vulnerability can be exploited through specially crafted web pages that make unauthorized requests to the affected endpoints when viewed by authenticated users (Jenkins Advisory).

As of the advisory publication date, there is no fix available for these vulnerabilities in the Job and Node ownership Plugin. Users should consider implementing additional access controls and monitoring of job ownership changes until a patch becomes available (Jenkins Advisory).