PT-2022-22050 · Jenkins · Jenkins Nested View Plugin+1

Kevin Guerroudj + 1 · Published 2022-06-22 · Updated 2023-11-03 · CVE-2022-34182

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Nested View Plugin versions 1.20 through 1.25

Description The issue is related to a reflected cross-site scripting (XSS) vulnerability. This occurs because the plugin does not escape search parameters. No information is provided about the estimated number of potentially affected devices or real-world incidents.

Recommendations For Jenkins Nested View Plugin versions 1.20 through 1.25, update to version 1.26 or later, which escapes search parameters and resolves the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-34182

GHSA-H642-5H74-3X9C

Affected Products

Jenkins

Jenkins Nested View Plugin

References · 6

• https://jenkins.io/security/advisory/2022-06-22/#SECURITY-2768 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h642-5h74-3x9c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34182 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34182 · Security Note
• https://github.com/jenkinsci/nested-view-plugin/commit/00505d69939bc45574ff27eecc06e997857e5bf6 · Note
• https://github.com/jenkinsci/nested-view-plugin · Note