Cross-site Scripting vulnerability in Jenkins

中 5.4CVE-2022-34170 · BIT-jenkins-2022-34170 · GHSA-62wf-24c4-8r76 · 23/06/2022 公開 · 17/06/2026 更新

要点

CVE-2022-34170 は org.jenkins-ci.main:jenkins-core, jenkins (jenkins) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.6%（全脆弱性の 75.3% より高い）。
対処：2.332.4, 2.346.1, 2.356 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jenkins-ci.main:jenkins-core Maven	`≥ 2.320, < 2.332.4≥ 2.346, < 2.346.1≥ 2.350, < 2.356`	`2.332.42.346.12.356`
jenkins jenkins	`≥ 2.320, ≤ 2.355≥ 2.332.1, ≤ 2.332.3`	修正版なし

概要

Since Jenkins 2.320 and LTS 2.332.1, help icon tooltips no longer escape the feature name, effectively undoing the fix for SECURITY-1955.

This vulnerability is known to be exploitable by attackers with Job/Configure permission.

Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability, the feature name in help icon tooltips is now escaped.

NVD の説明

In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.