GHSA-cvxj-4745-843x

Source

https://github.com/advisories/GHSA-cvxj-4745-843x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-cvxj-4745-843x/GHSA-cvxj-4745-843x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cvxj-4745-843x

Aliases

CVE-2022-43433

Published

2022-10-19T19:00:22Z

Modified

2023-11-08T04:10:44.013151Z

Severity

8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Content-Security-Policy protection for user content disabled by Jenkins ScreenRecorder Plugin

Details

Jenkins sets the Content-Security-Policy header to static files served by Jenkins (specifically DirectoryBrowserSupport), such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified.

ScreenRecorder Plugin 0.7 and earlier programmatically updates the Java system property allowing administrators to customize the Content-Security-Policy header for static files served by Jenkins to include media-src: 'self'. On a Jenkins instance with default configuration, this effectively disables all other directives in the default rule set, including script-src. This allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc.

Jenkins instances with Resource Root URL configured are unaffected.

Database specific

{
    "nvd_published_at": "2022-10-19T16:15:00Z",
    "github_reviewed_at": "2022-10-19T22:03:54Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-693"
    ]
}

References

Affected packages

Maven / io.jenkins.plugins:screenrecorder

Package

Name: io.jenkins.plugins:screenrecorder; View open source insights on deps.dev
Purl: pkg:maven/io.jenkins.plugins/screenrecorder

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.7

Affected versions

0.*

0.2

0.3

0.4

0.5

0.6

0.7