PT-2022-18294 · Jenkins · Jenkins Global-Build-Stats Plugin+1

S0Nnguy3N + 1 · Published 2022-03-15 · Updated 2023-11-15 · CVE-2022-27207

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins global-build-stats Plugin versions 1.5 and earlier

Description The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because multiple fields in the chart configuration on the 'Global Build Stats' page are not properly escaped. This vulnerability can be exploited by attackers who have Overall/Administer permission.

Recommendations For Jenkins global-build-stats Plugin versions 1.5 and earlier, update to a version later than 1.5 to resolve the issue. As a temporary workaround, consider restricting access to the 'Global Build Stats' page to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-27207

GHSA-WJ78-8XRX-PHR7

Affected Products

Jenkins

Jenkins Global-Build-Stats Plugin

References · 8

• https://jenkins.io/security/advisory/2022-03-15/#SECURITY-1886 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27207 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27207 · Security Note
• https://osv.dev/vulnerability/GHSA-wj78-8xrx-phr7 · Vendor Advisory
• https://github.com/jenkinsci/global-build-stats-plugin · Note
• https://github.com/jenkinsci/global-build-stats-plugin/commit/214f74360b3a91734b6e2a4b281ff0086a1e0679 · Note
• https://t.me/cibsecurity/38939 · Telegram Post
• http://openwall.com/lists/oss-security/2022/03/15/2 · Note