PT-2022-20424 · Jenkins · Jenkins Vboxwrapper Plugin+1

Daniel Beck + 2 · Published 2022-05-17 · Updated 2023-11-03 · CVE-2022-30968

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins vboxwrapper Plugin versions 1.3 and earlier

Description The Jenkins vboxwrapper Plugin does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability. This vulnerability is exploitable by attackers with Item/Configure permission. Exploitation requires that parameters are listed on another page, like the "Build With Parameters" and "Parameters" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the "Build With Parameters" and "Parameters" pages since 2.44 and LTS 2.32.2.

Recommendations For Jenkins vboxwrapper Plugin versions 1.3 and earlier, consider updating to a version that fixes this issue. As a temporary workaround, restrict access to the "Build With Parameters" and "Parameters" pages to minimize the risk of exploitation. Additionally, ensure that the Jenkins (core) version is 2.44 or later, or LTS 2.32.2 or later, to prevent exploitation of this vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-30968

GHSA-9W23-W757-MVV8

Affected Products

Jenkins

Jenkins Vboxwrapper Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-30968 · Security Note
• https://jenkins.io/security/advisory/2022-05-17/#SECURITY-2717 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9w23-w757-mvv8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30968 · Vendor Advisory
• https://github.com/jenkinsci/vboxwrapper-plugin · Note
• https://t.me/cvenotify/60443 · Telegram Post
• https://t.me/cibsecurity/42823 · Telegram Post