PT-2022-27951 · Jenkins · Jenkins Spring Config Plugin+1

Valdes Che Zogou + 1 · Published 2022-12-07 · Updated 2022-12-12 · CVE-2022-46687

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Spring Config Plugin versions 2.0.0 and earlier

Description The issue is a stored cross-site scripting (XSS) vulnerability. It occurs because build display names shown on the Spring Config view are not escaped, allowing attackers who can change build display names to exploit this vulnerability.

Recommendations For Jenkins Spring Config Plugin versions 2.0.0 and earlier, update to version 2.0.1 or later, which escapes build display names shown on the Spring Config view, thus resolving the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-46687

GHSA-3RRX-364R-6WF6

Affected Products

Jenkins

Jenkins Spring Config Plugin

References · 7

• https://osv.dev/vulnerability/GHSA-3rrx-364r-6wf6 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-12-07/#SECURITY-2814 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46687 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46687 · Vendor Advisory
• https://github.com/jenkinsci/spring-config-plugin/commit/89fea88b24f92233ed31050b8e695eb9b502b8c0 · Note
• https://github.com/jenkinsci/spring-config-plugin · Note
• https://t.me/cvenotify/39611 · Telegram Post