CVE-2022-41240: Stored XSS vulnerability in Jenkins Walti plugin
Summary
CVE-2022-41240: Stored XSS vulnerability in Jenkins Walti plugin. Affects org.jenkins-ci.plugins:walti versions < 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Walti Plugin is a Maven-based plugin that provides integration with the Walti API. It allows users to retrieve information from Walti and display it within Jenkins. The plugin is commonly used in Jenkins instances for monitoring and managing software projects. However, versions 1.0.1 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability arises from the failure of the Jenkins Walti Plugin to properly escape the information provided by the Walti API. This allows attackers to inject malicious code into the plugin's output, which can then be executed by unsuspecting users. The vulnerability can be exploited by attackers who are able to provide malicious API responses from Walti. The impact of this vulnerability is significant, as it allows attackers to execute arbitrary code within the context of the affected user's browser. This can lead to various malicious activities, including stealing sensitive information, performing actions on behalf of the user, or spreading malware.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the fix by upgrading to the latest version of the Jenkins Walti Plugin.
Conclusion
The Jenkins Walti Plugin 1.0.1 and earlier are vulnerable to a stored XSS attack. This can allow attackers to execute arbitrary code within the context of the affected user's browser, leading to various malicious activities. To mitigate this vulnerability, users should upgrade to version 1.0.2 of the plugin, which includes a fix for the issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:walti →
FAQ
The vulnerability allows attackers to execute arbitrary code within the context of the affected user's browser. This can lead to various malicious activities, including stealing sensitive information, performing actions on behalf of the user, or spreading malware.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
Yes, a fix is available for this vulnerability. Users should upgrade to version 1.0.2 of the Jenkins Walti Plugin, which includes a patch that addresses the issue.
No, there are no known workarounds for this vulnerability. It is necessary to apply the fix by upgrading to the latest version of the Jenkins Walti Plugin.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-7qpm-vmwv-hq7h/GHSA-7qpm-vmwv-hq7h.json).
