Cross-site Scripting vulnerability in Jenkins

MITTEL 5.4CVE-2022-34171 · BIT-jenkins-2022-34171 · GHSA-7f84-p6r5-jr6q · Published 23/06/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-34171 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in org.jenkins-ci.main:jenkins-core, jenkins (jenkins).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.6%, höher als bei 75.2% aller Schwachstellen.
Abhilfe: auf 2.346.1, 2.356, 2.332.4 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.jenkins-ci.main:jenkins-core Maven	`≥ 2.346, < 2.346.1≥ 2.350, < 2.356< 2.332.4`	`2.346.12.3562.332.4`
jenkins jenkins	`≥ 2.321, ≤ 2.355≥ 2.332.1, ≤ 2.332.3`	No fix yet

Description

Since Jenkins 2.321 and LTS 2.332.1, the HTML output generated for new symbol-based SVG icons includes the title attribute of l:ionicon until Jenkins 2.334 and alt attribute of l:icon since Jenkins 2.335 without further escaping.

This vulnerability is known to be exploitable by attackers with Job/Configure permission.

Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability, the title attribute of l:ionicon (Jenkins LTS 2.332.4) and alt attribute of l:icon (Jenkins 2.356 and LTS 2.346.1) are escaped in the generated HTML output.

NVD description

In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability.