CVE-2022-28138: 
Java vulnerability analysis and mitigation

A cross-site request forgery (CSRF) vulnerability was identified in Jenkins RocketChat Notifier Plugin versions 1.4.10 and earlier, tracked as CVE-2022-28138. The vulnerability was discovered by Marc Heyries and publicly disclosed on March 29, 2022. This security issue affects the form validation functionality in the RocketChat Notifier Plugin for Jenkins (Jenkins Advisory).

The vulnerability stems from a missing permission check in a method implementing form validation, combined with the absence of required POST requests. The severity is rated as Medium according to CVSS scoring. The vulnerability allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password credentials (Jenkins Advisory).

The vulnerability enables attackers with Overall/Read permission to perform unauthorized connections to arbitrary URLs using attacker-specified credentials. This could potentially lead to unauthorized access and credential exposure (Jenkins Advisory).

The vulnerability has been fixed in RocketChat Notifier Plugin version 1.5.0. The updated version implements proper security controls by requiring POST requests and Overall/Administer permission for the affected form validation method. Users are advised to upgrade to this version to mitigate the vulnerability (Jenkins Advisory).