GHSA-xpvp-h73c-m9rq

Source

https://github.com/advisories/GHSA-xpvp-h73c-m9rq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-xpvp-h73c-m9rq/GHSA-xpvp-h73c-m9rq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xpvp-h73c-m9rq

Aliases

Published

2022-09-22T00:00:28Z

Modified

2024-02-16T08:12:05.494203Z

Severity

8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Jenkins vulnerable to stored cross site scripting in the I:helpIcon component

Details

Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.

As of publication, the Jenkins security team is unaware of any exploitable help icon/tooltip in Jenkins core or plugins published by the Jenkins project. The vast majority of help icons use the l:help component instead of l:helpIcon. The few known instances of l:helpIcon do not have user-controllable tooltip contents.

Database specific

{
    "nvd_published_at": "2022-09-21T16:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-05T23:20:13Z"
}

References

Affected packages

Maven / org.jenkins-ci.main:jenkins-core

Package

Name: org.jenkins-ci.main:jenkins-core; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.main/jenkins-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.367

Fixed

2.370

Affected versions

2.*

2.367

2.368

2.369