GHSA-wmfh-h3vm-rcxm

Source

https://github.com/advisories/GHSA-wmfh-h3vm-rcxm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-wmfh-h3vm-rcxm/GHSA-wmfh-h3vm-rcxm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wmfh-h3vm-rcxm

Aliases

CVE-2022-43434

Published

2022-10-19T19:00:18Z

Modified

2024-02-16T08:01:29.531084Z

Severity

8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Content-Security-Policy protection for user content disabled by Jenkins NeuVector Vulnerability Scanner Plugin

Details

Jenkins sets the Content-Security-Policy header to static files served by Jenkins (specifically DirectoryBrowserSupport), such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified.

NeuVector Vulnerability Scanner Plugin 1.20 and earlier globally disables the Content-Security-Policy header for static files served by Jenkins whenever the 'NeuVector Vulnerability Scanner' build step is executed. This allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc.

Jenkins instances with Resource Root URL configured are unaffected.

Database specific

{
    "nvd_published_at": "2022-10-19T16:15:00Z",
    "cwe_ids": [
        "CWE-693"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-10-19T21:21:50Z"
}

References

Affected packages

Maven / io.jenkins.plugins:neuvector-vulnerability-scanner

Package

Name: io.jenkins.plugins:neuvector-vulnerability-scanner; View open source insights on deps.dev
Purl: pkg:maven/io.jenkins.plugins/neuvector-vulnerability-scanner

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.22

Affected versions

1.*

1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.7.1

1.8

1.8.1

1.9

1.10

1.11

1.12

1.13

1.14

1.15

1.16

1.17

1.17.1

1.18

1.19

1.20

1.21

Database specific

{
    "last_known_affected_version_range": "<= 1.20"
}