PT-2022-22055 · Jenkins · Jenkins Filesystem List Parameter Plugin+1

Daniel Beck + 2 · Published 2022-06-22 · Updated 2023-11-03 · CVE-2022-34187

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Filesystem List Parameter Plugin versions 0.0.7 and earlier

Description The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because the plugin does not escape the name and description of File system objects list parameters on views displaying parameters. This vulnerability is exploitable by attackers with Item/Configure permission. Exploitation requires that parameters are listed on another page and that those pages are not hardened to prevent exploitation.

Recommendations For Jenkins Filesystem List Parameter Plugin versions 0.0.7 and earlier, consider updating to a version that fixes this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-34187

GHSA-X95W-QF3M-PQPX

Affected Products

Jenkins

Jenkins Filesystem List Parameter Plugin

References · 7

• https://jenkins.io/security/advisory/2022-06-22/#SECURITY-2784 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34187 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34187 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x95w-qf3m-pqpx · Vendor Advisory
• https://github.com/jenkinsci/filesystem-list-parameter-plugin · Note
• https://t.me/cibsecurity/45036 · Telegram Post
• https://t.me/cvenotify/60451 · Telegram Post