CVE-2022-29036: Cross-site Scripting in Jenkins Credentials Plugin
Summary
CVE-2022-29036: Cross-site Scripting in Jenkins Credentials Plugin. Affects org.jenkins-ci.plugins:credentials across 4 version ranges.
< 2.6.1.1
>= 2.6.2, < 1074.1076.v39c30cecb_0e2
>= 1087.v16065d268466, < 1087.1089.v2f1b_9a_b_040e4
>= 1105, <= 1111.v35a
Fixed in 2.6.1.1, 1074.1076.v39c30cecb_0e2 or 1087.1089.v2f1b_9a_b_040e4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Credentials Plugin is a Maven package that provides functionality for managing and storing credentials in Jenkins. It allows users to securely store and use sensitive information such as usernames, passwords, and API keys. The plugin is widely used in Jenkins installations for various purposes, including authentication and authorization. However, versions 1111.v35a_307992395 and earlier of the plugin (except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1) are vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in the Jenkins Credentials Plugin arises from a failure to properly escape the name and description of Credentials parameters on views displaying parameters. This allows an attacker with Item/Configure permission to inject malicious scripts into the parameter fields, which can then be executed by unsuspecting users who view or interact with the affected views. The impact of this vulnerability can range from unauthorized access to sensitive information to the execution of arbitrary code on the affected Jenkins instance.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.1.12.6.1.1 -
>= 2.6.2, < 1074.1076.v39c30cecb_0e21074.1076.v39c30cecb_0e2 -
>= 1087.v16065d268466, < 1087.1089.v2f1b_9a_b_040e41087.1089.v2f1b_9a_b_040e4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a fixed version of the Jenkins Credentials Plugin.
Conclusion
The Jenkins Credentials Plugin is vulnerable to a stored cross-site scripting (XSS) attack, which can lead to unauthorized access to sensitive information or the execution of arbitrary code. It is crucial to upgrade to a fixed version of the plugin to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:credentials →
FAQ
The Jenkins Credentials Plugin is a Maven package that provides functionality for managing and storing credentials in Jenkins. It is widely used for authentication and authorization purposes.
The vulnerability allows an attacker to execute arbitrary code on the affected Jenkins instance, potentially leading to unauthorized access to sensitive information or other malicious activities.
Versions 1111.v35a_307992395 and earlier of the plugin are affected, except for versions 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1.
No, there are no known workarounds for this vulnerability. It is crucial to upgrade to a fixed version of the Jenkins Credentials Plugin.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:credentials.
