Promotion names in Jenkins promoted builds Plugin are not validated when using Job DSL

中 5.4CVE-2022-29049 · GHSA-jmxr-w2jc-qp7w · 12/04/2022 公開 · 17/06/2026 更新

要点

CVE-2022-29049 は org.jenkins-ci.plugins:promoted-builds, promoted builds (jenkins) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.82%（全脆弱性の 57.2% より高い）。
対処：876.v99d29788b, 3.10.1, 876.v99d29788b_36b_ 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jenkins-ci.plugins:promoted-builds Maven	`≥ 3.11, < 876.v99d29788b< 3.10.1`	`876.v99d29788b3.10.1`
promoted builds jenkins	`≥ 867.v7c3a_b_83a_eb_79, < 876.v99d29788b_36b_< 3.10.1`	`876.v99d29788b_36b_3.10.1`

概要

Jenkins promoted builds Plugin provides dedicated support for defining promotions using Job DSL Plugin.

promoted builds Plugin 873.v6149db_d64130 and earlier does not validate the names of promotions defined in Job DSL. This allows attackers with Job/Configure permission to create a promotion with an unsafe name. As a result, the promotion name could be used for cross-site scripting (XSS) or to replace other config.xml files.

promoted builds Plugin 876.v99d29788b_36b_ and 3.10.1 validates the name of promotions.

NVD の説明

Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name.