Stored Cross-Site Scripting Vulnerability in Jenkins Anchore Container Image Scanner Plugin

CVE-2022-41225

Summary

The Anchore Container Image Scanner Plugin for Jenkins, specifically version 1.0.24 and earlier, is vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability occurs due to improper escaping of content received from the Anchore engine API, allowing attackers to execute malicious scripts in the context of users' sessions. If an attacker has control over the API responses from the Anchore engine, they can exploit this flaw to inject malicious scripts, compromising the security of the Jenkins environment and potentially exposing sensitive data.

References