PT-2022-20419 · Jenkins · Jenkins Jdk Parameter Plugin+1

Kevin Guerroudj · Published 2022-05-17 · Updated 2023-11-03 · CVE-2022-30963

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins JDK Parameter Plugin version 1.0 and earlier

Description The issue results in a stored cross-site scripting (XSS) vulnerability, which is exploitable by attackers with Item/Configure permission. This occurs because the plugin does not escape the name and description of JDK parameters on views displaying parameters. Exploitation requires that parameters are listed on another page and that those pages are not hardened to prevent exploitation. It is noted that Jenkins (core) has prevented exploitation of vulnerabilities of this kind on certain pages since version 2.44 and LTS 2.32.2.

Recommendations For Jenkins JDK Parameter Plugin version 1.0 and earlier, consider updating to a version that escapes the name and description of JDK parameters to prevent stored cross-site scripting (XSS) vulnerabilities. As a temporary workaround, ensure that pages listing parameters are hardened to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-30963

GHSA-5PMP-7WC9-V7VW

Affected Products

Jenkins

Jenkins Jdk Parameter Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-30963 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30963 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-05-17/#SECURITY-2717 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5pmp-7wc9-v7vw · Vendor Advisory
• https://github.com/jenkinsci/JDK_Parameter_Plugin-plugin · Note
• https://t.me/cvenotify/30696 · Telegram Post
• https://t.me/cibsecurity/42811 · Telegram Post
• https://t.me/cvenotify/60445 · Telegram Post