Content-Security-Policy Bypass in Jenkins NeuVector Vulnerability Scanner Plugin

CVE-2022-43434

Summary

The Jenkins NeuVector Vulnerability Scanner Plugin, prior to version 1.21, contains a vulnerability that programmatically disables Content-Security-Policy (CSP) protections. This flaw affects user-generated content in workspaces and archived artifacts, allowing malicious actors to exploit this weakness and potentially compromise the integrity and security of the application. In environments utilizing this plugin, the absence of effective CSP can lead to various security risks, including cross-site scripting (XSS) attacks.

References