CVE-2022-34172: XSS
Published Jun 22, 2022
·Updated
In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting (XSS) vulnerability.
Affected Software
1 affected component
Jenkins Jenkins>=2.340<=2.355
Event History
Jun 22, 2022
CVE Published
via MITRE·02:40 PM
Data Sourced
via MITRE·02:40 PM
Description
Frequently Asked Questions
1
What is CVE-2022-34172?
CVE-2022-34172 is a vulnerability in Jenkins 2.340 through 2.355 that allows for cross-site scripting (XSS) attacks.
2
How severe is CVE-2022-34172?
CVE-2022-34172 has a severity rating of 6.1, which is considered medium.
3
What is the affected software for CVE-2022-34172?
The affected software for CVE-2022-34172 is Jenkins version 2.340 through 2.355.
4
How can I fix CVE-2022-34172?
To fix CVE-2022-34172, update your Jenkins installation to a version higher than 2.355.
5
Where can I find more information about CVE-2022-34172?
More information about CVE-2022-34172 can be found at the following link: [Jenkins Security Advisory](https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2781)