Jenkins Anchore Container Image Scanner Plugin vulnerable to cross site scripting

MEDIUM 5.4CVE-2022-41225 · GHSA-f2j5-w76m-3rqh · Published 21/09/2022 · updated 17/06/2026

In short

CVE-2022-41225 is a MEDIUM (CVSS 5.4) vulnerability affecting org.jenkins-ci.plugins:anchore-container-scanner, anchore container image scanner (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.72%, higher than 54.1% of all vulnerabilities.
Fix: update to 1.0.25 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:anchore-container-scanner Maven	`< 1.0.25`	`1.0.25`
anchore container image scanner jenkins	`< 1.0.25`	`1.0.25`

Description

Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control API responses by Anchore engine.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-41225 · ADVISORY
jenkinsci/anchore-container-scanner-plugin commit 1b1a62a · WEB
jenkinsci/anchore-container-scanner-plugin · PACKAGE
jenkins.io/security/advisory/2022-09-21 · WEB

More vulnerabilities in org.jenkins-ci.plugins:anchore-container-scanner

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:anchore-container-scanner

Maven

< 1.0.25

1.0.25

anchore container image scanner

jenkins

< 1.0.25

1.0.25

Description

NVD description

More vulnerabilities in org.jenkins-ci.plugins:anchore-container-scanner

See all →