PT-2022-22063 · Jenkins · Jenkins Readonly Parameter Plugin+1
Published
2022-06-22
·
Updated
2023-11-03
·
CVE-2022-34194
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Jenkins Readonly Parameter Plugin versions 1.0.0 and earlier
Description
The issue results in a stored cross-site scripting (XSS) vulnerability, which is exploitable by attackers with Item/Configure permission. This occurs because the plugin does not escape the name and description of Readonly String and Readonly Text parameters on views displaying parameters. Exploitation requires that parameters are listed on another page and that those pages are not hardened to prevent exploitation. It is noted that Jenkins (core) has prevented exploitation of similar vulnerabilities on certain pages since version 2.44 and LTS 2.32.2.
Recommendations
For Jenkins Readonly Parameter Plugin versions 1.0.0 and earlier, consider updating to a version that fixes this issue, although the specific fixed version is not provided in the available data. As a temporary workaround, restrict access to views displaying parameters to minimize the risk of exploitation. Additionally, ensure that any pages listing parameters, such as the "Build With Parameters" and "Parameters" pages, are properly hardened to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jenkins
Jenkins Readonly Parameter Plugin