CVE-2022-28151: 
Java vulnerability analysis and mitigation

CVE-2022-28151 is a missing permission check vulnerability discovered in Jenkins Job and Node ownership Plugin version 0.13.0 and earlier, disclosed on March 29, 2022. The vulnerability affects the plugin's HTTP endpoints and allows attackers with Item/Read permission to modify job ownership and permissions (Jenkins Advisory, OSS Security).

The vulnerability is classified as Medium severity and stems from a missing permission check in several HTTP endpoints of the Job and Node ownership Plugin. The issue is tracked as SECURITY-2062 (1) and allows unauthorized access to ownership and permission modification functions. This vulnerability is part of a broader security issue that also includes a CSRF vulnerability (CVE-2022-28150) (Jenkins Advisory).

When exploited, the vulnerability allows attackers with Item/Read permission to change the owners and item-specific permissions of a job, potentially leading to unauthorized access control modifications within Jenkins (Jenkins Advisory).

As of the advisory publication date, there was no fix available for this vulnerability in the Job and Node ownership Plugin. Users should monitor for updates and implement strict access controls to minimize risk (Jenkins Advisory).