CVE-2022-30962: Cross-site Scripting in Jenkins Global Variable String Parameter Plugin
Summary
CVE-2022-30962: Cross-site Scripting in Jenkins Global Variable String Parameter Plugin. Affects org.jenkins-ci.plugins:global-variable-string-parameter versions < 1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Global Variable String Parameter Plugin is a Maven package that provides functionality for defining and using global variable string parameters in Jenkins. These parameters allow users to define variables with string values that can be used across different Jenkins jobs. The plugin is widely used in Jenkins installations and is an integral part of many build and deployment processes.
Vulnerability Detail
The Jenkins Global Variable String Parameter Plugin version 1.2 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. The plugin does not properly escape the name and description of global variable string parameters when displaying them on certain views. This allows an attacker with Item/Configure permission to inject malicious scripts into the parameter names or descriptions, which can then be executed when the parameters are displayed on vulnerable pages. Exploitation of this vulnerability requires that the parameters are listed on pages like 'Build With Parameters' and 'Parameters' and that these pages are not hardened against XSS attacks. The vulnerability has a CVSS score of 8.0, indicating a high severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove or disable the use of global variable string parameters in their Jenkins jobs. This can be done by modifying the job configurations to remove any references to these parameters. However, this may impact the functionality of the jobs that rely on these parameters, so it is recommended to apply the official fix as soon as possible.
Conclusion
The Jenkins Global Variable String Parameter Plugin version 1.2 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. Users are advised to upgrade to a non-vulnerable version of the plugin, such as version 1.3 or above, to mitigate the risk of exploitation. In the meantime, users can remove or disable the use of global variable string parameters in their Jenkins jobs as a temporary workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:global-variable-string-parameter →
FAQ
The vulnerability allows an attacker to inject and execute arbitrary scripts in the context of the affected Jenkins installation. This can lead to various security risks, including unauthorized access to sensitive information, privilege escalation, and the ability to perform actions on behalf of legitimate users.
No, only versions 1.2 and earlier are affected by this vulnerability. Users of later versions, such as 1.3 and above, are not vulnerable and do not need to take any action.
No, this vulnerability requires an attacker to have Item/Configure permission in the Jenkins installation. It cannot be exploited remotely without first gaining administrative access to the Jenkins environment.
There is currently no evidence of active exploitation of this vulnerability. However, it is recommended to apply the fix as soon as possible to mitigate the risk of potential attacks.
More information about the fix and the latest version of the Jenkins Global Variable String Parameter Plugin can be found on the official Jenkins website and in the plugin documentation.
