Stored Cross-Site Scripting Vulnerability in Jenkins Anchore Container Image Scanner Plugin

CVE-2022-41225

What is CVE-2022-41225?

The Anchore Container Image Scanner Plugin for Jenkins, specifically version 1.0.24 and earlier, is vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability occurs due to improper escaping of content received from the Anchore engine API, allowing attackers to execute malicious scripts in the context of users' sessions. If an attacker has control over the API responses from the Anchore engine, they can exploit this flaw to inject malicious scripts, compromising the security of the Jenkins environment and potentially exposing sensitive data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References