PT-2022-22040 · Jenkins · Jenkins

Published 2022-06-22 · Updated 2024-03-06 · CVE-2022-34173

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.340 through 2.355

Description The tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability. This issue is exploitable by attackers with Job/Configure permission.

Recommendations For versions 2.340 through 2.355, update to Jenkins 2.356 or later, which addresses this vulnerability by escaping the tooltip of the build button in list views.

Fix

Path traversal

XSS

Weakness Enumeration

CWE-22

CWE-79

Related Identifiers

BIT-JENKINS-2022-34173

CVE-2022-34173

GHSA-6G4R-Q7QG-6QX6

Affected Products

Jenkins

References · 10

• https://jenkins.io/security/advisory/2022-06-22/#SECURITY-2781 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34173 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34173 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2022-34173 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6g4r-q7qg-6qx6 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://t.me/cvenotify/60440 · Telegram Post
• https://t.me/cvenotify/32356 · Telegram Post
• https://t.me/cibsecurity/45035 · Telegram Post
• https://t.me/cvenotify/37116 · Telegram Post