PT-2022-26918 · Jenkins · Jenkins Neuvector Vulnerability Scanner Plugin+1
Published
2022-10-19
·
Updated
2023-11-22
·
CVE-2022-43434
CVSS v3.1
8.0
High
| Vector | AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Jenkins NeuVector Vulnerability Scanner Plugin versions 1.20 and earlier
Description
The issue allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc. This is because the NeuVector Vulnerability Scanner Plugin programmatically disables Content-Security-Policy protection for user-generated content in these areas. Jenkins instances with a Resource Root URL configured are unaffected.
Recommendations
For Jenkins NeuVector Vulnerability Scanner Plugin versions 1.20 and earlier, consider disabling the plugin until a patch is available to prevent cross-site scripting attacks. Restrict access to user-generated content in workspaces and archived artifacts to minimize the risk of exploitation. Avoid using the
DirectoryBrowserSupport feature in Jenkins until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Protection Mechanism Failure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jenkins
Jenkins Neuvector Vulnerability Scanner Plugin