CVE-2022-28150: 
Java vulnerability analysis and mitigation

A cross-site request forgery (CSRF) vulnerability was identified in Jenkins Job and Node ownership Plugin version 0.13.0 and earlier, tracked as CVE-2022-28150. The vulnerability was discovered and disclosed on March 29, 2022, affecting the Jenkins automation server's Job and Node ownership Plugin (Jenkins Advisory).

The vulnerability stems from the plugin's failure to require POST requests for several HTTP endpoints. The severity is rated as Medium according to CVSS scoring. This vulnerability is specifically exploitable in Jenkins versions 2.286 and earlier, as well as LTS 2.277.1 and earlier (Jenkins Advisory).

When exploited, this vulnerability allows attackers with Item/Read permission to change the owners and item-specific permissions of a job through cross-site request forgery attacks (Jenkins Advisory).

The vulnerability is exploitable by attackers who have Item/Read permission in the Jenkins environment. The CSRF vulnerability is specifically limited to older Jenkins versions (2.286 and earlier, LTS 2.277.1 and earlier), which makes it less severe for updated installations (Jenkins Advisory).

As of the advisory's publication date, there was no fix available for this vulnerability in the Job and Node ownership Plugin. Users are advised to upgrade their Jenkins core installation to versions newer than 2.286 or LTS 2.277.1 to reduce the risk of exploitation (Jenkins Advisory).