Content-Security-Policy protection for user content disabled by Jenkins XFramium Builder Plugin

MEDIUM 4.3CVE-2022-43432 · GHSA-px4x-hjm5-w8x3 · Published 19/10/2022 · updated 17/06/2026

In short

CVE-2022-43432 is a MEDIUM (CVSS 4.3) vulnerability affecting org.jenkins-ci.plugins:xframium, xframium builder (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.66%, higher than 51.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:xframium Maven	`≤ 1.0.22`	No fix yet
xframium builder jenkins	`≤ 1.0.22`	No fix yet

Description

Jenkins sets the Content-Security-Policy header to static files served by Jenkins (specifically DirectoryBrowserSupport), such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified.

XFramium Builder Plugin 1.0.22 and earlier globally disables the Content-Security-Policy header for static files served by Jenkins as soon as it is loaded. This allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc.

Jenkins instances with Resource Root URL configured are unaffected.

NVD description

Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.

References

nvd.nist.gov/vuln/detail/CVE-2022-43432 · ADVISORY
jenkinsci/xframium-plugin · PACKAGE
jenkins.io/security/advisory/2022-10-19 · WEB
openwall.com/lists/oss-security/2022/10/19/3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:xframium

Maven

≤ 1.0.22

No fix yet

xframium builder

jenkins

≤ 1.0.22

No fix yet

Description

Jenkins instances with Resource Root URL configured are unaffected.

NVD description