Stored Cross-Site Scripting Vulnerability in Jenkins Job Configuration History Plugin
CVE-2022-38664

5.4MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Job Configuration History Plugin
Vendor
CVE Published:
23 August 2022

What is CVE-2022-38664?

The Jenkins Job Configuration History Plugin prior to version 1165.v8cc9fd1f4597 contains a vulnerability that fails to properly escape job names displayed on the System Configuration History page. This oversight allows an attacker with access to configure job names to inject malicious scripts into the page, potentially leading to exploitation of users visiting that page. It highlights the importance of input validation and proper encoding to mitigate such risks.

Affected Version(s)

Jenkins Job Configuration History Plugin <= 1165.v8cc9fd1f4597

References

https://www.jenkins.io/security/advisory/2022-08-23/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2022/08/23/2
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.