PT-2022-22053 · Jenkins · Jenkins Date Parameter Plugin+1

Published

2022-06-22

·

Updated

2023-11-03

·

CVE-2022-34185

CVSS v3.1

8.0

High

VectorAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Jenkins Date Parameter Plugin versions 0.0.4 and earlier
Description The issue is a stored cross-site scripting (XSS) vulnerability that occurs because the Jenkins Date Parameter Plugin does not escape the name and description of Date parameters on views displaying parameters. This vulnerability is exploitable by attackers with Item/Configure permission. Exploitation requires that parameters are listed on another page, like the "Build With Parameters" and "Parameters" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the "Build With Parameters" and "Parameters" pages since 2.44 and LTS 2.32.2.
Recommendations For Jenkins Date Parameter Plugin versions 0.0.4 and earlier, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the "Build With Parameters" and "Parameters" pages to minimize the risk of exploitation. Additionally, ensure that the Jenkins (core) version is at least 2.44 or LTS 2.32.2 to prevent exploitation of this kind of vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-34185
GHSA-5HH2-F4H9-446G

Affected Products

Jenkins
Jenkins Date Parameter Plugin