~ / search / GHSA-6g4r-q7qg-6qx6

GHSA-6g4r-q7qg-6qx6

Cross-site Scripting vulnerability in Jenkins

Source: GitHub Advisory Database (reviewed) High CVE-2022-34173

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.main:jenkins-core >= 2.340, < 2.356 2.356

Details

As written in the advisory (Markdown source, shown as plain text).

Since Jenkins 2.340, the tooltip of the build button in list views supports HTML without escaping the job display name. This vulnerability is known to be exploitable by attackers with Job/Configure permission. Jenkins 2.356 addresses this vulnerability. The tooltip of the build button in list views is now escaped. No Jenkins LTS release is affected by SECURITY-2776 or SECURITY-2780, as these were not present in Jenkins 2.332.x and fixed in the 2.346.x line before 2.346.1.

References

External links from the advisory. They lead to third-party sites.