PT-2022-20416 · Jenkins · Jenkins Application Detector Plugin+1

Daniel Beck + 2 · Published 2022-05-17 · Updated 2023-11-02 · CVE-2022-30960

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Application Detector Plugin versions 1.0.8 and earlier

Description The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because the plugin does not escape the name of Chois Application Version parameters on views displaying parameters. This vulnerability is exploitable by attackers with Item/Configure permission.

Recommendations For Jenkins Application Detector Plugin versions 1.0.8 and earlier, consider disabling the parameter display for Chois Application Version until a patch is available. Restrict access to views displaying parameters to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-30960

GHSA-6WH8-MR6F-6CX2

Affected Products

Jenkins

Jenkins Application Detector Plugin

References · 7

• https://osv.dev/vulnerability/GHSA-6wh8-mr6f-6cx2 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-05-17/#SECURITY-2717 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30960 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30960 · Vendor Advisory
• https://github.com/jenkinsci/app-detector-plugin · Note
• https://t.me/cvenotify/30700 · Telegram Post
• https://t.me/cibsecurity/42826 · Telegram Post