PT-2022-22045 · Jenkins · Jenkins Embeddable Build Status Plugin+1

Kevin Guerroudj + 1 · Published 2022-06-22 · Updated 2023-11-03 · CVE-2022-34178

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Embeddable Build Status Plugin version 2.0.3

Description The issue allows specifying a link query parameter for build status badges without restricting possible values, resulting in a reflected cross-site scripting (XSS) vulnerability. This means an attacker could potentially inject malicious code into the badge link.

Recommendations For Jenkins Embeddable Build Status Plugin version 2.0.3, consider updating to version 2.0.4, which limits URLs to http and https protocols and correctly escapes the provided value. As a temporary workaround, consider restricting the use of the link query parameter until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-34178

GHSA-39R3-H8Q6-2PHQ

Affected Products

Jenkins

Jenkins Embeddable Build Status Plugin

References · 7

• https://osv.dev/vulnerability/GHSA-39r3-h8q6-2phq · Vendor Advisory
• https://jenkins.io/security/advisory/2022-06-22/#SECURITY-2567 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34178 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34178 · Security Note
• https://github.com/jenkinsci/embeddable-build-status-plugin/commit/0fc4a199506328b08dcd0aca572a2ca79ca38714 · Note
• https://github.com/jenkinsci/embeddable-build-status-plugin · Note
• https://t.me/cibsecurity/45011 · Telegram Post