PT-2022-24514 · Jenkins · Jenkins Job Configuration History Plugin+1

Kevin Guerroudj · Published 2022-08-23 · Updated 2023-11-02 · CVE-2022-38664

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Job Configuration History Plugin versions 1165.v8cc9fd1f4597 and earlier

Description The issue results in a stored cross-site scripting (XSS) vulnerability. This occurs because the job name on the System Configuration History page is not properly escaped. Attackers who can configure job names may exploit this vulnerability.

Recommendations For Jenkins Job Configuration History Plugin versions 1165.v8cc9fd1f4597 and earlier, update to a version that properly escapes job names on the System Configuration History page to prevent stored cross-site scripting (XSS) attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-38664

GHSA-28W4-H56G-GRG7

Affected Products

Jenkins

Jenkins Job Configuration History Plugin

References · 8

• https://osv.dev/vulnerability/CVE-2022-38664 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-08-23/#SECURITY-2765 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38664 · Security Note
• https://osv.dev/vulnerability/GHSA-28w4-h56g-grg7 · Vendor Advisory
• https://github.com/jenkinsci/job-config-history-plugin/commit/c9f255f45b8a6ed008d66be094526adfd80ca035 · Note
• https://github.com/jenkinsci/job-config-history-plugin · Note
• http://openwall.com/lists/oss-security/2022/08/23/2 · Note
• https://t.me/cibsecurity/48616 · Telegram Post