PT-2022-27950 · Jenkins · Jenkins Custom Build Properties Plugin+1

Kevin Guerroudj + 1 · Published 2022-12-07 · Updated 2022-12-12 · CVE-2022-46686

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Custom Build Properties Plugin versions 2.79.vc095ccc85094 and earlier

Description The issue results in a stored cross-site scripting (XSS) vulnerability due to the plugin not escaping property values and build display names on the Custom Build Properties and Build Summary pages. This makes it exploitable by attackers who can set or change these values.

Recommendations For versions 2.79.vc095ccc85094 and earlier, update to version 2.82.v16d5b d3590c7 or later, which escapes property values and build display names on the Custom Build Properties and Build Summary pages.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-46686

GHSA-5G2C-J6V9-VF94

Affected Products

Jenkins

Jenkins Custom Build Properties Plugin

References · 8

• https://osv.dev/vulnerability/GHSA-5g2c-j6v9-vf94 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-12-07/#SECURITY-2810 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46686 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46686 · Vendor Advisory
• https://github.com/jenkinsci/custom-build-properties-plugin · Note
• https://github.com/jenkinsci/custom-build-properties-plugin/commit/ff4e27181389955cbb051c1c91f0c85c6adbced0 · Note
• https://t.me/cvenotify/39670 · Telegram Post
• https://t.me/cvenotify/39612 · Telegram Post