GitHub Advisoryadvisory · Maven

GHSA-7f84-p6r5-jr6q Cross-site Scripting vulnerability in Jenkins

HIGH Published 2022-06-24 Modified 2022-12-06 Official page ↗
Aliases
CVE-2022-34171
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-22, CWE-79
Reviewed
2022-12-06

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 2.350, < 2.356 → fixed in 2.356 • Maven org.jenkins-ci.main:jenkins-core: >= 2.346, < 2.346.1 → fixed in 2.346.1 • Maven org.jenkins-ci.main:jenkins-core: < 2.332.4 → fixed in 2.332.4

Description

Since Jenkins 2.321 and LTS 2.332.1, the HTML output generated for new symbol-based SVG icons includes the `title` attribute of `l:ionicon` until Jenkins 2.334 and `alt` attribute of `l:icon` since Jenkins 2.335 without further escaping. This vulnerability is known to be exploitable by attackers with Job/Configure permission. Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability, the `title` attribute of `l:ionicon` (Jenkins LTS 2.332.4) and `alt` attribute of `l:icon` (Jenkins 2.356 and LTS 2.346.1) are escaped in the generated HTML output.

Related

Alias · CVE (1)

  • CVE-2022-34171 In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new… vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References