Description
In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins | 2.320 – < unspecified, unspecified – ≤ 2.355, LTS 2.332.1 – < unspecified, unspecified – ≤ LTS 2.332.3 | unspecified |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | jenkins | 2.346.2-r0 | — |
| Alpine v3.23 | jenkins | 2.346.2-r0 | — |
| Alpine v3.22 | jenkins | 2.346.2-r0 | — |
| Alpine v3.21 | jenkins | 2.346.2-r0 | — |
| Alpine v3.20 | jenkins | 2.346.2-r0 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | jenkins | 2.346.2-r0 | — |
| Alpine v3.18 | jenkins | 2.346.2-r0 | — |
| Alpine v3.17 | jenkins | 2.346.2-r0 | — |
| Alpine v3.16 | jenkins | 2.346.2-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.350, < 2.356 | 2.356 | GHSA-62wf-24c4-8r76 |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.320, < 2.332.4 | 2.332.4 | GHSA-62wf-24c4-8r76 |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.346, < 2.346.1 | 2.346.1 | GHSA-62wf-24c4-8r76 |
Advisories 1
- WID-SEC-2022-0445 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 22, 2023