CVE-2022-34193: Cross-site Scripting in Jenkins Package Version Plugin
Summary
CVE-2022-34193: Cross-site Scripting in Jenkins Package Version Plugin. Affects org.lilicurroad.jenkins:packageversion versions < 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Package Version Plugin is a Maven package that provides functionality for managing package versions in Jenkins. It allows users to define and manage package versions as parameters in Jenkins views. This plugin is vulnerable to a stored cross-site scripting (XSS) attack, which can be exploited by attackers with Item/Configure permission.
Vulnerability Detail
The vulnerability arises from the plugin's failure to properly escape the name of Package version parameters on views displaying parameters. This allows an attacker to inject malicious scripts into the parameter name, which will be executed when the parameter is rendered on vulnerable pages. To exploit this vulnerability, the attacker needs to list the parameters on pages like 'Build With Parameters' and 'Parameters' and have the necessary permissions. Jenkins (core) has implemented measures to prevent exploitation of similar vulnerabilities on these pages since version 2.44 and LTS 2.32.2. However, the Package Version Plugin has not implemented these measures, making it susceptible to XSS attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the Item/Configure permission from untrusted users to mitigate the risk of exploitation. Additionally, users can manually escape the parameter names when defining them, ensuring that any user-supplied input is properly sanitized to prevent XSS attacks.
Conclusion
The Jenkins Package Version Plugin is vulnerable to a stored cross-site scripting (XSS) attack, which can be mitigated by updating to the latest version and ensuring that Jenkins is up to date with security patches. Users should also consider removing Item/Configure permission from untrusted users as a temporary workaround. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.lilicurroad.jenkins:packageversion →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts in the context of the user's browser, potentially leading to unauthorized access, data theft, or other malicious activities.
No, this vulnerability requires the attacker to have Item/Configure permission and access to pages displaying the parameters.
Updating the Jenkins Package Version Plugin to the latest version is the recommended mitigation. Additionally, removing Item/Configure permission from untrusted users can reduce the risk of exploitation.
Yes, Jenkins (core) has implemented measures to prevent exploitation of similar vulnerabilities on the 'Build With Parameters' and 'Parameters' pages since version 2.44 and LTS 2.32.2.
Yes, this vulnerability is identified as CVE-2022-34193.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
