PT-2022-22038 · Jenkins · Jenkins

Published 2022-06-22 · Updated 2024-03-06 · CVE-2022-34171

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.321 through 2.355 Jenkins LTS versions 2.332.1 through 2.332.3

Description The HTML output generated for new symbol-based SVG icons in Jenkins includes the title attribute of l:ionicon (until Jenkins 2.334) and alt attribute of l:icon (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability. This issue is known to be exploitable by attackers with Job/Configure permission.

Recommendations For Jenkins versions 2.321 through 2.355, update to version 2.356 or later to address the vulnerability. For Jenkins LTS versions 2.332.1 through 2.332.3, update to version 2.332.4 or later to address the vulnerability. As a temporary workaround, consider restricting access to the HTML output generated for new symbol-based SVG icons until a patch is available.

Fix

Path traversal

XSS

Weakness Enumeration

CWE-22

CWE-79

Related Identifiers

BIT-JENKINS-2022-34171

CVE-2022-34171

GHSA-7F84-P6R5-JR6Q

Affected Products

Jenkins

References · 10

• https://jenkins.io/security/advisory/2022-06-22/#SECURITY-2781 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34171 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34171 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2022-34171 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7f84-p6r5-jr6q · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://t.me/cibsecurity/45009 · Telegram Post
• https://t.me/cvenotify/60438 · Telegram Post
• https://t.me/cvenotify/37115 · Telegram Post
• https://t.me/cvenotify/32354 · Telegram Post