GHSA-f2j5-w76m-3rqh

Jenkins Anchore Container Image Scanner Plugin vulnerable to cross site scripting

Source: GitHub Advisory Database (reviewed) High CVE-2022-41225

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:anchore-container-scanner	< 1.0.25	1.0.25

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control API responses by Anchore engine.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-41225 advisory
https://github.com/jenkinsci/anchore-container-scanner-plugin/commit/1b1a62ab8ab86b409274e755860ab4e7fcc11800 web
https://github.com/jenkinsci/anchore-container-scanner-plugin package
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2821 web