PT-2022-25756 · Jenkins · Jenkins Walti Plugin+1

Wadeck Follonier · Published 2022-09-21 · Updated 2025-05-28 · CVE-2022-41240

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Walti Plugin versions 1.0.1 and earlier

Description The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because the plugin does not escape the information provided by the Walti API, making it exploitable by attackers who can provide malicious API responses from Walti.

Recommendations For Jenkins Walti Plugin versions 1.0.1 and earlier, consider disabling the plugin until a patch is available to prevent exploitation of the stored XSS vulnerability. Restrict access to the Walti API to minimize the risk of malicious responses.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-41240

GHSA-7QPM-VMWV-HQ7H

Affected Products

Jenkins

Jenkins Walti Plugin

References · 9

• https://osv.dev/vulnerability/GHSA-7qpm-vmwv-hq7h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41240 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41240 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-09-21/#SECURITY-1870 · Vendor Advisory
• https://github.com/jenkins-infra/update-center2/pull/644 · Note
• https://github.com/jenkinsci/walti-plugin · Note
• https://t.me/cvenotify/123872 · Telegram Post
• https://plugins.jenkins.io/walti · Note
• https://t.me/cibsecurity/50216 · Telegram Post