PT-2022-22043 · Jenkins · Jenkins Junit Plugin+1

Wadeck Follonier · Published 2022-06-22 · Updated 2023-11-03 · CVE-2022-34176

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins JUnit Plugin versions 1119.va a 5e9068da d7 and earlier

Description The issue results in a stored cross-site scripting (XSS) vulnerability because descriptions of test results are not properly escaped. This vulnerability is exploitable by attackers with Run/Update permission.

Recommendations For versions 1119.va a 5e9068da d7 and earlier, update to a version that applies the configured markup formatter to descriptions of test results, such as version 1119.1121.vc43d0fc45561, to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-34176

GHSA-64MJ-3P92-589V

RHSA-2022:6531

RHSA-2023:0017

Affected Products

Jenkins

Jenkins Junit Plugin

References · 9

• https://jenkins.io/security/advisory/2022-06-22/#SECURITY-2760 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34176 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34176 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-64mj-3p92-589v · Vendor Advisory
• https://github.com/jenkinsci/junit-plugin/commit/c43d0fc455619dd652ec87939ac3d70d6134fea1 · Note
• https://github.com/jenkinsci/junit-plugin · Note
• https://t.me/cibsecurity/44981 · Telegram Post
• https://t.me/cvenotify/32364 · Telegram Post
• https://t.me/cvenotify/60441 · Telegram Post