PT-2022-4023 · Jenkins · Jenkins Lucene-Search Plugin+1

Published 2022-07-27 · Updated 2023-11-02 · CVE-2022-36922

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Lucene-Search Plugin versions 370.v62a5f618cd3a and earlier

Description The issue exists due to the lack of protection for the web page structure. Exploitation of this issue may allow a remote attacker to conduct a cross-site scripting (XSS) attack. The vulnerability is caused by the failure to escape the search query parameter displayed on the 'search' result page, resulting in a reflected cross-site scripting (XSS) vulnerability.

Recommendations For Jenkins Lucene-Search Plugin versions 370.v62a5f618cd3a and earlier, update to a version that properly escapes the search query parameter to prevent XSS attacks. As a temporary workaround, consider restricting access to the search result page until a patch is available. Avoid using the search query parameter in the affected page until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-04856

CVE-2022-36922

GHSA-6954-H5C8-M29F

Affected Products

Jenkins

Jenkins Lucene-Search Plugin

References · 8

• https://jenkins.io/security/advisory/2022-07-27/#SECURITY-2812 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36922 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6954-h5c8-m29f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36922 · Security Note
• https://bdu.fstec.ru/vul/2022-04856 · Security Note
• https://github.com/jenkinsci/lucene-search-plugin/commit/5f9fd00d83a5a73a7b9579e8139b3db3a9065ed2 · Note
• http://openwall.com/lists/oss-security/2022/07/27/1 · Note
• https://t.me/cibsecurity/47089 · Telegram Post