CVE-2022-41225

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-41225

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-41225.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-41225

Aliases

GHSA-f2j5-w76m-3rqh

Published

2022-09-21T16:15:09.917Z

Modified

2026-07-10T07:39:23.041722Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control API responses by Anchore engine.

References

https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2821

Affected packages

Git / github.com/jenkinsci/anchore-container-scanner-plugin

Affected ranges

Type

GIT

Repo

https://github.com/jenkinsci/anchore-container-scanner-plugin

Events

Introduced

Fixed

4c6208b98a2b4960b7cc9e6682b59c282ba919ae

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0.25"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:jenkins:anchore_container_image_scanner:*:*:*:*:*:jenkins:*:*"
}

Affected versions

anchore-container-scanner-1.*

anchore-container-scanner-1.0.0

anchore-container-scanner-1.0.1

anchore-container-scanner-1.0.11

anchore-container-scanner-1.0.12

anchore-container-scanner-1.0.13

anchore-container-scanner-1.0.14

anchore-container-scanner-1.0.15

anchore-container-scanner-1.0.16

anchore-container-scanner-1.0.17

anchore-container-scanner-1.0.18

anchore-container-scanner-1.0.19

anchore-container-scanner-1.0.2

anchore-container-scanner-1.0.20

anchore-container-scanner-1.0.21

anchore-container-scanner-1.0.22

anchore-container-scanner-1.0.23

anchore-container-scanner-1.0.24

anchore-container-scanner-1.0.3

anchore-container-scanner-1.0.4

anchore-container-scanner-1.0.5

anchore-container-scanner-1.0.6

anchore-container-scanner-1.0.7

anchore-container-scanner-1.0.8

anchore-container-scanner-1.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-41225.json"