CVE-2022-34784: XSS

Published Jun 30, 2022

Updated

Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Build/Update permission.

Affected Software

1 affected component

jenkins Build-metrics Jenkins=1.3

Event History

Jun 30, 2022

CVE Published

via MITRE·05:46 PM

Data Sourced

via MITRE·05:46 PM

Description

Frequently Asked Questions

What is the severity of CVE-2022-34784?

CVE-2022-34784 is classified as a medium severity vulnerability due to its potential for stored cross-site scripting (XSS) attacks.

How do I fix CVE-2022-34784?

To fix CVE-2022-34784, update the Jenkins build-metrics Plugin to version 1.4 or later, which addresses the escaping issue.

Who is affected by CVE-2022-34784?

Users of Jenkins with build-metrics Plugin version 1.3 are affected by CVE-2022-34784 if they have Build/Update permissions.

What type of vulnerability is CVE-2022-34784?

CVE-2022-34784 is a stored cross-site scripting (XSS) vulnerability.

Can CVE-2022-34784 be exploited remotely?

Yes, CVE-2022-34784 can be exploited remotely by attackers who have the necessary Build/Update permissions.