PT-2022-18282 · Jenkins · Jenkins Favorite Plugin+1

Kevin Guerroudj + 1 · Published 2022-03-15 · Updated 2023-11-22 · CVE-2022-27196

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Favorite Plugin versions 2.4.0 and earlier

Description The issue results in a stored cross-site scripting (XSS) vulnerability. This occurs because the names of jobs in the favorite column are not properly escaped. Attackers with Item/Configure or Item/Create permissions can exploit this.

Recommendations For Jenkins Favorite Plugin versions 2.4.0 and earlier, update to a version later than 2.4.0 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-27196

GHSA-874R-46C6-7P4R

Affected Products

Jenkins

Jenkins Favorite Plugin

References · 7

• https://osv.dev/vulnerability/CVE-2022-27196 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-874r-46c6-7p4r · Vendor Advisory
• https://jenkins.io/security/advisory/2022-03-15/#SECURITY-2557 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27196 · Security Note
• https://github.com/jenkinsci/favorite-plugin · Note
• https://github.com/jenkinsci/favorite-plugin/commit/543a4d87c4fade02173f793905a99adec517bc3b · Note
• http://openwall.com/lists/oss-security/2022/03/15/2 · Note