PT-2023-28169 · Jenkins · Jenkins Job Configuration History Plugin+1

Andrea Chiera · Published 2023-09-06 · Updated 2023-09-11 · CVE-2023-41931

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Job Configuration History Plugin versions 1227.v7a 79fc4dc01f and earlier

Description The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because the timestamp value from history entries is not properly sanitized or escaped when rendering a history entry on the history view. This allows for malicious scripts to be stored and executed, potentially leading to security breaches.

Recommendations For Jenkins Job Configuration History Plugin versions 1227.v7a 79fc4dc01f and earlier, consider disabling the rendering of history entries on the history view until a patch is available. Restrict access to the history view to minimize the risk of exploitation. Avoid using the timestamp value from history entries in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-41931

GHSA-5JXP-F5RR-G6JC

Affected Products

Jenkins

Jenkins Job Configuration History Plugin

References · 9

• https://jenkins.io/security/advisory/2023-09-06/#SECURITY-3233 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41931 · Security Note
• https://osv.dev/vulnerability/GHSA-5jxp-f5rr-g6jc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41931 · Vendor Advisory
• https://twitter.com/CVEnew/status/1699416763296047209 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1699436735657115887 · Twitter Post
• https://t.me/cibsecurity/70001 · Telegram Post
• http://openwall.com/lists/oss-security/2023/09/06/9 · Note
• https://t.me/cvenotify/57620 · Telegram Post