Description
Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). Users with the permission to configure jobs were able to inject JavaScript into parameter names and descriptions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | jenkins | jenkins 2.44, jenkins 2.32.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.32.2 | 2.32.2 | GHSA-r69c-5j7c-vm6q |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.34, < 2.44 | 2.44 | GHSA-r69c-5j7c-vm6q |
Advisories 4
- WID-SEC-2022-1804 Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 14, 2024
- WID-SEC-2023-0090 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 15, 2023
- WID-SEC-2022-0265 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 6, 2023
- WID-SEC-2022-0445 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 22, 2023
References
- https://jenkins.io/security/advisory/2017-02-01/
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2601
- 95960 vdb-entry
- https://github.com/jenkinsci/jenkins/commit/fd2e081b947124c90bcd97bfc55e1a7f2ef41a74
- [oss-security] 20220412 Multiple vulnerabilities in Jenkins plugins mailing-list
- [oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins mailing-list
- [oss-security] 20220622 Multiple vulnerabilities in Jenkins and Jenkins plugins mailing-list
- [oss-security] 20220630 Multiple vulnerabilities in Jenkins plugins mailing-list
- [oss-security] 20221019 Multiple vulnerabilities in Jenkins plugins mailing-list