CVE-2022-30953
Cross Site Request Forgery in Jenkins Blue Ocean Plugin
6.5 MediumFix available
A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
0.73%Down 0.2 points since May 18, 2022
What each source reports
NVD Score used
A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.
- Record
CVE-2022-30953- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.
- Record
CVE-2022-30953- Updated
- 2026-11-02
EUVDEUVD-2022-4145 No score
A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.
- Record
EUVD-2022-4145- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hgpq-42pf-9vfq
Cross Site Request Forgery in Jenkins Blue Ocean Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server. Blue Ocean Plugin 1.25.4 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
- Record
GHSA-hgpq-42pf-9vfq- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.
- Record
CVE-2022-30953- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-hgpq-42pf-9vfq
Cross Site Request Forgery in Jenkins Blue Ocean Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server. Blue Ocean Plugin 1.25.4 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
- Record
GHSA-hgpq-42pf-9vfq- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
Show 6 moreShow less
OSVRHSA-2023:0017
Red Hat Security Advisory: OpenShift Container Platform 4.8.56 packages and security update
- Record
RHSA-2023:0017- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:0560
Red Hat Security Advisory: OpenShift Container Platform 4.10.51 security update
- Record
RHSA-2023:0560- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:0777
Red Hat Security Advisory: OpenShift Container Platform 4.9.56 security update
- Record
RHSA-2023:0777- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:3198
Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
- Record
RHSA-2023:3198- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:3610
Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
- Record
RHSA-2023:3610- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:3622
Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
- Record
RHSA-2023:3622- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.jenkins.blueocean:blueocean-parentMaven |
before 1.25.4 | 1.25.4 |
io.jenkins.blueocean:blueocean-parentMaven |
before 1.25.4, plus listed versions 1.0-alpha-11.0-alpha-21.0-alpha-31.0-alpha-41.0-alpha-5 Show 45 moreShow less1.0-alpha-61.0-alpha-71.0-alpha-81.0-alpha-91.0.01.0.0-b011.0.0-b021.0.0-b031.0.0-b041.0.0-b051.0.0-b061.0.0-b071.0.0-b081.0.0-b091.0.0-b101.0.0-b111.0.0-b121.0.0-b131.0.0-b141.0.0-b151.0.0-b161.0.0-b171.0.0-b181.0.0-b191.0.0-b19-beta-11.0.0-b201.0.0-b20-beta-11.0.0-b211.0.0-b21-beta-11.0.0-b221.0.0-b231.0.0-b241.0.0-b251.0.0-rc11.0.0-rc21.0.0-rc31.0.0-rc41.0.11.1.01.1.0-beta-11.1.0-beta-21.1.0-beta-31.1.0-beta-41.1.0-beta-81.1.0-beta-9 |
1.25.4 |
jenkinsRed Hat:openshift:4.8::el8 From an advisory covering 16 CVEs |
before 0:2.361.1.1672840472-1.el8 | 0:2.361.1.1672840472-1.el8 |
jenkins-2-pluginsRed Hat:openshift:4.8::el8 From an advisory covering 16 CVEs |
before 0:4.8.1672842762-1.el8 | 0:4.8.1672842762-1.el8 |
jenkins-2-pluginsRed Hat:openshift:4.10::el8 From an advisory covering 23 CVEs |
before 0:4.10.1675144701-1.el8 | 0:4.10.1675144701-1.el8 |
jenkins-2-pluginsRed Hat:openshift:4.9::el8 From an advisory covering 26 CVEs |
before 0:4.9.1675668922-1.el8 | 0:4.9.1675668922-1.el8 |
jenkinsRed Hat:openshift:4.9::el8 From an advisory covering 26 CVEs |
before 0:2.361.1.1675668150-1.el8 | 0:2.361.1.1675668150-1.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.11::el8 From an advisory covering 22 CVEs |
before 0:4.11.1683009941-1.el8 | 0:4.11.1683009941-1.el8 |
jenkinsRed Hat:ocp_tools:4.11::el8 From an advisory covering 22 CVEs |
before 0:2.387.1.1683009763-3.el8 | 0:2.387.1.1683009763-3.el8 |
jenkinsRed Hat:ocp_tools:4.12::el8 From an advisory covering 13 CVEs |
before 0:2.401.1.1686649641-3.el8 | 0:2.401.1.1686649641-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.12::el8 From an advisory covering 13 CVEs |
before 0:4.12.1686649756-1.el8 | 0:4.12.1686649756-1.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.13::el8 From an advisory covering 9 CVEs |
before 0:4.13.1686680473-1.el8 | 0:4.13.1686680473-1.el8 |
jenkinsRed Hat:ocp_tools:4.13::el8 From an advisory covering 9 CVEs |
before 0:2.401.1.1686680404-3.el8 | 0:2.401.1.1686680404-3.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-30953 is a medium vulnerability (CVSS 6.5) in Jenkins Blue Ocean, published May 17, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in io.jenkins.blueocean:blueocean-parent 1.25.4.
References
jenkins.io/security/advisory/2022-05-17
openwall.com/lists/oss-security/2022/05/17/8
nvd.nist.gov/vuln/detail/CVE-2022-30953
github.com/jenkinsci/blueocean-plugin/commit/9f44b895d018c514d5dccc1f2190a2a029e58259
Show 194 moreShow less
access.redhat.com/errata/RHSA-2023:0017
bugzilla.redhat.com/show_bug.cgi?id=2074855
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0017.json
cve.org/CVERecord?id=CVE-2022-2048
bitbucket.org/snakeyaml/snakeyaml/issues/525
mail-archive.com/[email protected]/msg39312.html
docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html
maven.apache.org/docs/3.8.1/release-notes.html
blogs.apache.org/security/entry/cve-2022-42889
lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
seclists.org/oss-sec/2022/q4/22
research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633
spring.io/blog/2023/03/20/spring-framework-6-0-7-and-5-3-26-fix-cve-2023-20860-and-cve-2023-20861
This page doesn't list everything
Left out here: 102 versions and 45 references. The JSON record has them.