CVE-2022-36902: Stored XSS vulnerability in Jenkins Dynamic Extended Choice Parameter plugin
Summary
CVE-2022-36902: Stored XSS vulnerability in Jenkins Dynamic Extended Choice Parameter plugin. Affects com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter versions < 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Dynamic Extended Choice Parameter Plugin is a Maven package that provides extended choice parameters for Jenkins, allowing users to dynamically generate and select parameter values. This plugin is commonly used in Jenkins pipelines and jobs to provide more flexible and customizable parameter options. However, versions 1.0.1 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in the Jenkins Dynamic Extended Choice Parameter Plugin arises from a failure to properly escape certain fields of Moded Extended Choice parameters. This allows an attacker with Item/Configure permission to inject malicious scripts into the affected fields, which will then be executed when the parameter values are rendered on the Jenkins interface. This stored XSS vulnerability can be exploited to perform various malicious actions, such as stealing sensitive information, performing unauthorized actions on behalf of the user, or spreading malware.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to the latest version of the plugin is not immediately feasible, a temporary workaround is to restrict Item/Configure permission to trusted users only. By limiting access to the affected fields, the risk of exploitation can be mitigated. However, this is not a permanent solution, and upgrading to the fixed version is still strongly advised.
Conclusion
The Jenkins Dynamic Extended Choice Parameter Plugin is vulnerable to a stored XSS attack, allowing attackers to execute arbitrary scripts in the context of users with Item/Configure permission. To address this vulnerability, it is recommended to upgrade to version 1.0.2 or later of the plugin. If immediate upgrading is not possible, restricting access to the affected fields can provide temporary mitigation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter →
FAQ
This vulnerability allows an attacker to execute arbitrary scripts in the context of the user viewing the affected parameter fields. This can lead to various malicious activities, including data theft, unauthorized actions, and the spread of malware.
Users of Jenkins Dynamic Extended Choice Parameter Plugin versions 1.0.1 and earlier are affected by this vulnerability. It is important for Jenkins administrators and users to update to the fixed version to protect their systems.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, given the nature of the vulnerability and its potential impact, it is important to address it promptly.
No, this vulnerability requires an attacker to have Item/Configure permission in Jenkins. It cannot be exploited remotely without some level of access to the Jenkins environment.
Yes, the CVSS score for this vulnerability is 8.0, indicating a high severity level. It is crucial to take immediate action to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter.
