PT-2022-19389 · Jenkins · Jenkins Promoted Builds Plugin+1

Kevin Guerroudj + 1 · Published 2022-04-12 · Updated 2023-12-21 · CVE-2022-29049

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins promoted builds Plugin versions 873.v6149db d64130 and earlier, except version 3.10.1

Description The issue allows attackers with Job/Configure permission to create a promotion with an unsafe name, as the names of promotions defined in Job DSL are not validated. This could be used for cross-site scripting (XSS) or to replace other config.xml files.

Recommendations For versions 873.v6149db d64130 and earlier, except version 3.10.1, update to a version that validates the name of promotions, such as version 876.v99d29788b 36b or later. As a temporary workaround, consider restricting the Job/Configure permission to minimize the risk of exploitation. Avoid using unsafe names for promotions until the issue is resolved.

Fix

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

CVE-2022-29049

GHSA-JMXR-W2JC-QP7W

Affected Products

Jenkins

Jenkins Promoted Builds Plugin

References · 8

• https://osv.dev/vulnerability/GHSA-jmxr-w2jc-qp7w · Vendor Advisory
• https://jenkins.io/security/advisory/2022-04-12/#SECURITY-2655 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29049 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29049 · Vendor Advisory
• https://github.com/jenkinsci/promoted-builds-plugin/commit/d6fd95688ae2052bf9ac7158bc2579c755167fe0 · Note
• https://github.com/jenkinsci/promoted-builds-plugin · Note
• https://t.me/cvenotify/28797 · Telegram Post
• https://t.me/cvenotify/64781 · Telegram Post