PT-2022-26905 · Jenkins · Jenkins Contrast Continuous Application Security Plugin+1

Yaroslav Afenkin · Published 2022-10-19 · Updated 2025-05-08 · CVE-2022-43420

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Contrast Continuous Application Security Plugin versions 3.9 and earlier

Description The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because the plugin does not escape data returned from the Contrast service when generating a report. This allows attackers who can control or modify Contrast service API responses to exploit the vulnerability.

Recommendations For versions 3.9 and earlier, update to version 3.10 or later, which escapes the affected data and resolves the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-43420

GHSA-HVCR-927W-QCVQ

Affected Products

Jenkins

Jenkins Contrast Continuous Application Security Plugin

References · 9

• https://jenkins.io/security/advisory/2022-10-19/#SECURITY-2836 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43420 · Security Note
• https://osv.dev/vulnerability/GHSA-hvcr-927w-qcvq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43420 · Vendor Advisory
• https://github.com/jenkinsci/contrast-continuous-application-security-plugin/commit/1babcd1e972a265527af12a9f85393d08937859c · Note
• https://github.com/jenkinsci/contrast-continuous-application-security-plugin · Note
• https://t.me/cvenotify/121434 · Telegram Post
• https://t.me/cibsecurity/51799 · Telegram Post
• http://openwall.com/lists/oss-security/2022/10/19/3 · Note