GitHub Advisoryadvisory · Maven

GHSA-6g4r-q7qg-6qx6 Cross-site Scripting vulnerability in Jenkins

HIGH Published 2022-06-24 Modified 2022-12-05 Official page ↗
Aliases
CVE-2022-34173
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-22, CWE-79
Reviewed
2022-12-05

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 2.340, < 2.356 → fixed in 2.356

Description

Since Jenkins 2.340, the tooltip of the build button in list views supports HTML without escaping the job display name. This vulnerability is known to be exploitable by attackers with Job/Configure permission. Jenkins 2.356 addresses this vulnerability. The tooltip of the build button in list views is now escaped. No Jenkins LTS release is affected by SECURITY-2776 or SECURITY-2780, as these were not present in Jenkins 2.332.x and fixed in the 2.346.x line before 2.346.1.

Related

Alias · CVE (1)

  • CVE-2022-34173 In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job… vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References