PT-2022-22037 · Jenkins · Jenkins

Published 2022-06-22 · Updated 2024-03-06 · CVE-2022-34170

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.320 through 2.355 Jenkins LTS versions 2.332.1 through 2.332.3

Description The help icon in Jenkins does not escape the feature name that is part of its tooltip, resulting in a cross-site scripting (XSS) vulnerability. This issue is exploitable by attackers with Job/Configure permission. The vulnerability effectively undoes the fix for a previous security issue.

Recommendations For Jenkins versions 2.320 through 2.355, update to version 2.356 or later to resolve the issue. For Jenkins LTS versions 2.332.1 through 2.332.3, update to version 2.332.4 or later, or version 2.346.1 or later, to resolve the issue.

Fix

Path traversal

XSS

Weakness Enumeration

CWE-22

CWE-79

Related Identifiers

BIT-JENKINS-2022-34170

CVE-2022-34170

GHSA-62WF-24C4-8R76

Affected Products

Jenkins

References · 11

• https://jenkins.io/security/advisory/2022-06-22/#SECURITY-2781 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34170 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2022-34170 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34170 · Security Note
• https://osv.dev/vulnerability/GHSA-62wf-24c4-8r76 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/f71495a63f8b861e8ca3a5fcf5cc931fce55bc57 · Note
• https://t.me/cvenotify/32352 · Telegram Post
• https://t.me/cvenotify/60446 · Telegram Post
• https://t.me/cvenotify/37114 · Telegram Post
• https://t.me/cibsecurity/45041 · Telegram Post