CVE-2022-34790: Cross-site Scripting in Jenkins eXtreme Feedback Panel Plugin
Summary
CVE-2022-34790: Cross-site Scripting in Jenkins eXtreme Feedback Panel Plugin. Affects org.jenkins-ci.plugins:xfpanel versions < 2.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins eXtreme Feedback Panel Plugin is a Maven-based plugin that provides a visual representation of the status of Jenkins jobs. It allows users to monitor the progress and health of their jobs through a feedback panel. The plugin is widely used in Jenkins installations to enhance visibility and improve collaboration among team members. However, versions 2.0.1 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in the Jenkins eXtreme Feedback Panel Plugin arises from the lack of proper escaping of job names used in tooltips. This allows attackers with Item/Configure permission to inject malicious scripts into the tooltips, which are then executed when users hover over the affected job names. As a result, an attacker can exploit this vulnerability to perform various malicious actions, such as stealing sensitive information, performing unauthorized actions on behalf of the user, or redirecting users to malicious websites. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.0.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading the plugin is not immediately feasible, a temporary workaround can be implemented by disabling the tooltips feature in the Jenkins eXtreme Feedback Panel Plugin. This can be done by modifying the plugin configuration file or disabling the plugin entirely until the upgrade can be performed. However, it is strongly recommended to upgrade to the latest version as soon as possible to ensure full protection against this vulnerability.
Conclusion
The Jenkins eXtreme Feedback Panel Plugin versions 2.0.1 and earlier are vulnerable to a stored cross-site scripting (XSS) attack. This can be exploited by attackers with Item/Configure permission to inject and execute malicious scripts in the context of affected users. To mitigate this vulnerability, it is recommended to upgrade the plugin to version 2.0.2 or later. Alternatively, users can disable the tooltips feature or temporarily disable the plugin until the upgrade can be performed. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:xfpanel →
FAQ
The vulnerability allows attackers to execute arbitrary scripts in the context of the affected user's browser. This can lead to various malicious activities, including data theft, unauthorized actions, and the redirection of users to malicious websites.
Users of Jenkins eXtreme Feedback Panel Plugin versions 2.0.1 and earlier are affected by this vulnerability. It is recommended for all users of the plugin to upgrade to the latest version to ensure their systems are protected.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the recommended fix as soon as possible to prevent potential exploitation.
No, this vulnerability requires an attacker to have Item/Configure permission in the Jenkins instance. It cannot be exploited remotely without authenticated access to the Jenkins system.
For more information about this vulnerability, including technical details and updates, refer to the GitHub Security Advisory GHSA-w257-f7qj-4vrq.
