PT-2022-26893 · Jenkins · Jenkins Pipeline: Supporting Apis Plugin+1
Daniel Beck
+2
·
Published
2022-10-19
·
Updated
2023-11-01
·
CVE-2022-43409
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Jenkins Pipeline: Supporting APIs Plugin versions 838.va 3a 087b 4055b and earlier
Description
The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because the Jenkins Pipeline: Supporting APIs Plugin does not properly sanitize or encode URLs of hyperlinks that send POST requests in build logs. This vulnerability is exploitable by attackers who have the ability to create Pipelines. The plugin provides features to add hyperlinks to build logs, which are used by other plugins to allow users to interact with builds. However, the failure to properly encode these URLs results in the vulnerability.
Recommendations
For versions 838.va 3a 087b 4055b and earlier, update to version 839.v35e2736cfd5c or later, which properly encodes URLs of hyperlinks in build logs. As a temporary workaround, consider restricting the ability to create Pipelines to trusted users until the update can be applied.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jenkins
Jenkins Pipeline: Supporting Apis Plugin