CVE-2022-30970: Cross-site Scripting in Jenkins Autocomplete Parameter Plugin
Summary
CVE-2022-30970: Cross-site Scripting in Jenkins Autocomplete Parameter Plugin. Affects org.jenkins-ci.plugins:autocomplete-parameter versions < 1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Autocomplete Parameter Plugin is a Maven package (org.jenkins-ci.plugins:autocomplete-parameter) that provides functionality for dropdown autocomplete parameters and auto-complete string parameters in Jenkins. These parameters allow users to select or input values from a predefined list. However, versions 1.1 and earlier of the plugin contain a vulnerability that allows for cross-site scripting (XSS) attacks. This vulnerability arises from unsafe handling of parameter names in view definitions, which can be exploited by attackers with Item/Configure permission.
Vulnerability Detail
The vulnerability in the Jenkins Autocomplete Parameter Plugin allows for stored cross-site scripting (XSS) attacks. By embedding malicious JavaScript code in view definitions, an attacker can execute arbitrary code in the context of a user's browser. This vulnerability is independent of other attempts to prevent XSS vulnerabilities in parameter names and can be exploited even on views that implement such measures. The impact of this vulnerability is significant, as it allows an attacker to potentially steal sensitive information, perform actions on behalf of the user, or manipulate the user interface.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the plugin to a non-vulnerable version as soon as possible.
Conclusion
The Jenkins Autocomplete Parameter Plugin versions 1.1 and earlier are vulnerable to a stored cross-site scripting (XSS) attack. It is crucial to update to version 1.2 or later to mitigate this vulnerability. Additionally, review and update the security permissions of users with Item/Configure permission to minimize the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:autocomplete-parameter →
FAQ
The vulnerability allows for stored cross-site scripting (XSS) attacks, which can lead to unauthorized access, data theft, and manipulation of the user interface.
Attackers with Item/Configure permission in Jenkins can exploit this vulnerability.
The only effective mitigation is to update the Jenkins Autocomplete Parameter Plugin to a non-vulnerable version.
There is no known instance of this vulnerability being exploited in the wild.
No, this vulnerability requires attackers to have Item/Configure permission in Jenkins.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:autocomplete-parameter.
