CVE-2022-34171: XSS
In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-34171?
CVE-2022-34171 is a vulnerability in Jenkins versions 2.321 through 2.355 and LTS versions 2.332.1 through 2.332.3. It allows the HTML output for new symbol-based SVG icons to include certain attributes without proper escaping.
How severe is CVE-2022-34171?
The severity of CVE-2022-34171 is medium, with a CVSS score of 6.1.
What is the affected software for CVE-2022-34171?
The affected software for CVE-2022-34171 includes Jenkins versions 2.321 through 2.355 and LTS versions 2.332.1 through 2.332.3.
How can I fix CVE-2022-34171?
To fix CVE-2022-34171, update Jenkins to a version beyond 2.355 or LTS version beyond 2.332.3.
Where can I find more information about CVE-2022-34171?
More information about CVE-2022-34171 can be found at the following link: [CVE-2022-34171 Advisory](https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2781).