PT-2022-25754 · Jenkins · Jenkins Dotci Plugin+1

Daniel Beck · Published 2022-09-21 · Updated 2025-05-28 · CVE-2022-41239

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins DotCi Plugin versions 2.40.00 and earlier

Description The issue results in a stored cross-site scripting (XSS) vulnerability due to the failure to escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause. This vulnerability is exploitable by attackers able to submit crafted commit notifications to the "/githook/" endpoint. The vulnerability is only exploitable in certain versions of Jenkins, specifically 2.314 and earlier, and LTS 2.303.1 and earlier.

Recommendations For Jenkins DotCi Plugin versions 2.40.00 and earlier, consider disabling the display of commit notifications in the build cause until a patch is available. Restrict access to the "/githook/" endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the GitHub user name parameter in commit notifications until the issue is resolved. For Jenkins versions 2.314 and earlier, and LTS 2.303.1 and earlier, follow the LTS upgrade guide to upgrade to a newer version.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-41239

GHSA-Q9G4-9FX4-V533

Affected Products

Jenkins

Jenkins Dotci Plugin

References · 9

• https://jenkins.io/security/advisory/2022-09-21/#SECURITY-2884 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41239 · Security Note
• https://osv.dev/vulnerability/GHSA-q9g4-9fx4-v533 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41239 · Vendor Advisory
• https://github.com/jenkinsci/DotCi · Note
• https://plugins.jenkins.io/DotCi · Note
• https://jenkins.io/security/plugins/#suspensions · Note
• https://t.me/cibsecurity/50218 · Telegram Post
• https://t.me/cvenotify/123871 · Telegram Post