PT-2022-25739 · Jenkins · Jenkins

Daniel Beck · Published 2022-09-21 · Updated 2024-03-06 · CVE-2022-41224

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.367 through 2.369

Description The issue results in a stored cross-site scripting (XSS) vulnerability due to the lack of escaping tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI. This vulnerability is exploitable by attackers able to control tooltips for this component. As of publication, the Jenkins security team is unaware of any exploitable help icon/tooltip in Jenkins core or plugins published by the Jenkins project. The vast majority of help icons use the l:help component instead of l:helpIcon. The few known instances of l:helpIcon do not have user-controllable tooltip contents.

Recommendations For Jenkins versions 2.367 through 2.369, consider disabling the l:helpIcon UI component until a patch is available to prevent potential exploitation of the stored cross-site scripting vulnerability. Restrict access to the Jenkins web UI to minimize the risk of exploitation. Avoid using user-controllable tooltips in the l:helpIcon component until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-JENKINS-2022-41224

CVE-2022-41224

GHSA-XPVP-H73C-M9RQ

Affected Products

Jenkins

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-41224 · Security Note
• https://osv.dev/vulnerability/GHSA-xpvp-h73c-m9rq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41224 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-09-21/#SECURITY-2886 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2022-41224 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/84f41d2921023374dedb7d6f12d47eaf7790b7eb · Note
• https://t.me/cvenotify/36679 · Telegram Post