CVE-2022-34178: XSS
Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible values, resulting in a reflected cross-site scripting (XSS) vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-34178?
CVE-2022-34178 has been classified as a medium severity vulnerability due to its potential to cause reflected cross-site scripting (XSS).
How do I fix CVE-2022-34178?
To remediate CVE-2022-34178, upgrade the Jenkins Embeddable Build Status Plugin to version 2.0.4 or later.
What type of vulnerability is CVE-2022-34178?
CVE-2022-34178 is a reflected cross-site scripting (XSS) vulnerability caused by improper handling of the 'link' query parameter.
Which versions of Jenkins are affected by CVE-2022-34178?
CVE-2022-34178 affects Jenkins Embeddable Build Status Plugin version 2.0.3.
Can CVE-2022-34178 be exploited remotely?
Yes, CVE-2022-34178 can be exploited remotely if an attacker is able to craft a special URL to execute a cross-site scripting attack.