CVE-2022-34786: Cross-site Scripting in Jenkins Rich Text Publisher Plugin
Summary
CVE-2022-34786: Cross-site Scripting in Jenkins Rich Text Publisher Plugin. Affects org.jenkins-ci.plugins:rich-text-publisher-plugin versions < 1.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Rich Text Publisher Plugin is a Maven package that provides a post-build step for Jenkins jobs to publish rich text messages. It allows users to customize the HTML message that is displayed after a build. The plugin is widely used in Jenkins environments to enhance the visual presentation of build results and communicate important information to users. However, versions 1.4 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in the Jenkins Rich Text Publisher Plugin arises from the failure to properly escape HTML messages set by the post-build step. This allows attackers with job configuration privileges to inject malicious scripts into the HTML message, which will be executed when viewed by other users. The impact of this vulnerability can range from stealing sensitive information, such as session cookies, to performing actions on behalf of the victim user. The vulnerability has a CVSS score of 8.0, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the Jenkins Rich Text Publisher Plugin or remove the post-build step that sets the HTML message. This will prevent the execution of any injected scripts. However, this workaround may impact the visual presentation of build results and the ability to communicate important information through rich text messages.
Conclusion
The Jenkins Rich Text Publisher Plugin versions 1.4 and earlier are vulnerable to a stored cross-site scripting (XSS) attack. This can allow attackers to inject malicious scripts into the HTML message, potentially leading to the theft of sensitive information or unauthorized actions. It is recommended to upgrade to a non-affected version of the plugin or apply the provided workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:rich-text-publisher-plugin →
FAQ
The vulnerability allows attackers to inject malicious scripts into the HTML message of the Jenkins Rich Text Publisher Plugin. This can lead to various consequences, including stealing sensitive information and performing actions on behalf of the victim user.
To fix this vulnerability, it is recommended to upgrade to a non-affected version of the Jenkins Rich Text Publisher Plugin. The latest version should have the necessary security patches to prevent XSS attacks.
Yes, disabling the Jenkins Rich Text Publisher Plugin or removing the post-build step that sets the HTML message can serve as a temporary workaround. However, this may impact the visual presentation of build results and the ability to communicate important information through rich text messages.
Yes, the CVSS score for this vulnerability is 8.0, indicating a high severity level.
For more information about this vulnerability, you can visit the Vulert Playground at Vulert Scanner. Vulert is a platform that monitors and alerts in real-time for open-source vulnerabilities in software, using just the pom.xml file.
