Stored XSS vulnerability in Jenkins Pipeline: Supporting APIs Plugin

中 5.4CVE-2022-43409 · GHSA-64r9-x74q-wxmh · 19/10/2022 公開 · 17/06/2026 更新

要点

CVE-2022-43409 は org.jenkins-ci.plugins.workflow:workflow-support, pipeline (jenkins) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.82%（全脆弱性の 57.4% より高い）。
対処：839.v35e2736cfd5c 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jenkins-ci.plugins.workflow:workflow-support Maven	`< 839.v35e2736cfd5c`	`839.v35e2736cfd5c`
pipeline jenkins	`≤ 838.va_3a_087b_4055b`	修正版なし

概要

Pipeline: Supporting APIs Plugin provides a feature to add hyperlinks, that send POST requests when clicked, to build logs. These links are used by Pipeline: Input Step Plugin to allow users to proceed or abort the build, or by Pipeline: Job Plugin to allow users to forcibly terminate the build after aborting it.

Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of these hyperlinks in build logs.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Pipelines.

Pipeline: Supporting APIs Plugin 839.v35e2736cfd5c properly encodes URLs of these hyperlinks in build logs.

NVD の説明

Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Pipelines.