PT-2023-5740 · Jenkins · Jenkins Docker Swarm Plugin+1

Kevin Guerroudj + 1 · Published 2023-08-16 · Updated 2023-08-18 · CVE-2023-40350

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Docker Swarm Plugin versions 1.11 and earlier

Description The issue is related to the Jenkins Docker Swarm Plugin, which does not properly escape values returned from Docker before inserting them into the Docker Swarm Dashboard view. This results in a stored cross-site scripting (XSS) vulnerability that can be exploited by attackers who can control responses from Docker. The vulnerability allows remote attackers to conduct cross-site scripting attacks using a specially crafted link.

Recommendations For Jenkins Docker Swarm Plugin versions 1.11 and earlier: At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the Docker Swarm Dashboard view to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved or a patch is available.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-06412

CVE-2023-40350

GHSA-V9RW-HJR3-426H

Affected Products

Jenkins

Jenkins Docker Swarm Plugin

References · 10

• https://osv.dev/vulnerability/GHSA-v9rw-hjr3-426h · Vendor Advisory
• https://jenkins.io/security/advisory/2023-08-16/#SECURITY-2811 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40350 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40350 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06412 · Security Note
• https://twitter.com/VulmonFeeds/status/1691853708642976044 · Twitter Post
• https://twitter.com/CVEnew/status/1691822031157817406 · Twitter Post
• http://openwall.com/lists/oss-security/2023/08/16/3 · Note
• https://t.me/cvenotify/56793 · Telegram Post
• https://t.me/cibsecurity/68658 · Telegram Post