PT-2022-18844 · Unknown+1 · Toad Edge Plugin+1

Daniel Beck · Published 2022-03-29 · Updated 2023-11-17 · CVE-2022-28145

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Continuous Integration with Toad Edge Plugin versions 2.3 and earlier

Description The issue is related to the lack of Content-Security-Policy headers in report files served by the software, resulting in a stored cross-site scripting (XSS) exploit. Attackers with Item/Configure permission or those who can control report contents can exploit this issue.

Recommendations For versions 2.3 and earlier, consider disabling the report serving feature until a patch is available, or restrict access to report files to minimize the risk of exploitation. Additionally, limiting Item/Configure permission to trusted users can help mitigate the risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-28145

GHSA-7JH8-GHWC-82CW

Affected Products

Jenkins

Toad Edge Plugin

References · 9

• https://jenkins.io/security/advisory/2022-03-29/#SECURITY-1892 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28145 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28145 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7jh8-ghwc-82cw · Vendor Advisory
• https://github.com/jenkinsci/ci-with-toad-edge-plugin · Note
• https://github.com/jenkinsci/ci-with-toad-edge-plugin/commit/d6b2292949d0cddf4a2981fefbf3e30d1dfcd88a · Note
• http://openwall.com/lists/oss-security/2022/03/29/1 · Note
• https://t.me/cvenotify/60605 · Telegram Post
• https://t.me/cibsecurity/39726 · Telegram Post