CVE-2022-34189: Cross-site Scripting in Jenkins Image Tag Parameter Plugin
Summary
CVE-2022-34189: Cross-site Scripting in Jenkins Image Tag Parameter Plugin. Affects org.jenkins-ci.plugins:image-tag-parameter versions < 1.10. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Image Tag Parameter Plugin is a Maven package that provides functionality for defining image tag parameters in Jenkins views. These parameters allow users to select specific image tags when running builds. The plugin is vulnerable to a stored cross-site scripting (XSS) attack, which can be exploited by attackers with Item/Configure permission. The vulnerability arises from the plugin's failure to properly escape the name and description of Image Tag parameters on views displaying parameters.
Vulnerability Detail
The stored XSS vulnerability in the Jenkins Image Tag Parameter Plugin allows attackers with Item/Configure permission to inject malicious scripts into the name and description fields of Image Tag parameters. When these parameters are listed on certain pages, such as the 'Build With Parameters' and 'Parameters' pages, the injected scripts can be executed in the context of other users who view these pages. This can lead to various consequences, including the theft of sensitive information, session hijacking, and unauthorized actions on behalf of the affected users.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the Jenkins Image Tag Parameter Plugin or restrict access to the 'Build With Parameters' and 'Parameters' pages. Disabling the plugin will remove the ability to use Image Tag parameters, but it will also eliminate the associated vulnerability. Restricting access to the affected pages can help mitigate the risk of exploitation by limiting the number of potential targets.
Conclusion
The Jenkins Image Tag Parameter Plugin is vulnerable to a stored XSS attack, which can be exploited by attackers with Item/Configure permission. To mitigate this vulnerability, it is crucial to update the plugin to version 1.11 or later and harden the 'Build With Parameters' and 'Parameters' pages. Disabling the plugin or restricting access to the affected pages can serve as temporary workarounds. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:image-tag-parameter →
FAQ
The vulnerability allows attackers to execute arbitrary scripts in the context of other users, potentially leading to information theft, session hijacking, and unauthorized actions.
Attackers with Item/Configure permission in Jenkins can exploit this vulnerability.
Updating the Jenkins Image Tag Parameter Plugin to version 1.11 or later and hardening the 'Build With Parameters' and 'Parameters' pages can mitigate this vulnerability.
Disabling the Jenkins Image Tag Parameter Plugin or restricting access to the affected pages can serve as temporary workarounds.
Yes, the CVSS score for this vulnerability is 8.0 (High).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:image-tag-parameter.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
