CVE-2022-41224: XSS
First published: Wed Sep 21 2022(Updated: )
Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the `l:helpIcon` UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component. As of publication, the Jenkins security team is unaware of any exploitable help icon/tooltip in Jenkins core or plugins published by the Jenkins project. The vast majority of help icons use the `l:help` component instead of l:helpIcon. The few known instances of `l:helpIcon` do not have user-controllable tooltip contents.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Jenkins | >=2.367<=2.369 | |
| Jenkins Jenkins | >=2.367<2.370 | |
| maven/org.jenkins-ci.main:jenkins-core | >=2.367<2.370 | 2.370 |
| >=2.367<2.370 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Jenkins vulnerability?
The vulnerability ID is CVE-2022-41224.
What is the severity level of CVE-2022-41224?
CVE-2022-41224 has a severity level of medium.
How can an attacker exploit CVE-2022-41224?
An attacker can exploit CVE-2022-41224 by controlling tooltips for the l:helpIcon UI component in Jenkins 2.367 through 2.369, resulting in a stored cross-site scripting (XSS) vulnerability.
Which versions of Jenkins are affected by CVE-2022-41224?
Jenkins versions 2.367 through 2.369 (inclusive) are affected by CVE-2022-41224.
Where can I find more information about CVE-2022-41224?
You can find more information about CVE-2022-41224 at the following link: [https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2886](https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2886)
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/github-advisory
- source/GitHub
- alias/GHSA-xpvp-h73c-m9rq
- alias/CVE-2022-41224
- agent/software-canonical-lookup
- collector/github-advisory-latest
- collector/nvd-api
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- package-manager/maven
- vendor/jenkins
- canonical/jenkins jenkins
- version/jenkins jenkins/2.367
- version/jenkins jenkins/2.369