CVE-2022-25191: Stored Cross-site Scripting vulnerability in Jenkins Agent Server Parameter Plugin
Summary
CVE-2022-25191: Stored Cross-site Scripting vulnerability in Jenkins Agent Server Parameter Plugin. Affects io.jenkins.plugins:agent-server-parameter versions < 1.1. Fixed in 1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Agent Server Parameter Plugin is a Maven package (io.jenkins.plugins:agent-server-parameter) used in Jenkins, an open-source automation server. This plugin allows users to define agent server parameters in Jenkins jobs, which can be used to configure and control Jenkins agents. These parameters are stored and can be accessed by users with Item/Configure permission.
Vulnerability Detail
The Jenkins Agent Server Parameter Plugin version 1.0 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. The plugin does not properly escape parameter names of agent server parameters, allowing an attacker with Item/Configure permission to inject malicious scripts into the parameter names. When these parameters are displayed or used in the Jenkins UI, the injected scripts will be executed in the context of the victim's browser, potentially leading to unauthorized actions or data theft.
How To Fix
Minimum fixed version
1.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the plugin as soon as possible.
Conclusion
The Jenkins Agent Server Parameter Plugin version 1.0 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. Users are advised to upgrade to version 1.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:agent-server-parameter →
FAQ
This vulnerability allows an attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to unauthorized actions or data theft.
Users of Jenkins Agent Server Parameter Plugin versions 1.0 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report.
No, this vulnerability can only be exploited by authenticated users with Item/Configure permission.
Yes, the vulnerability has been fixed in version 1.1 of the Jenkins Agent Server Parameter Plugin.
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.plugins:agent-server-parameter.
