CVE-2022-43409: XSS
A Cross-site scripting (XSS) vulnerability was found in a Jenkins plugin. This issue may allow an authenticated remote attacker to create Pipelines.
Other sources
Jenkins Pipeline: Supporting APIs Plugin 838.va3a087b4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Pipelines.
Pipeline: Supporting APIs Plugin provides a feature to add hyperlinks, that send POST requests when clicked, to build logs. These links are used by Pipeline: Input Step Plugin to allow users to proceed or abort the build, or by Pipeline: Job Plugin to allow users to forcibly terminate the build after aborting it.
Pipeline: Supporting APIs Plugin 838.va3a087b4055b and earlier does not sanitize or properly encode URLs of these hyperlinks in build logs.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Pipelines.
Pipeline: Supporting APIs Plugin 839.v35e2736cfd5c properly encodes URLs of these hyperlinks in build logs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 2-plugins-0:4.11.1683009941-1.el8 - Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 2-plugins-0:4.12.1675702407-1.el8 - Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 2-plugins-0:4.10.1675144701-1.el8 - Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 2-plugins-0:4.9.1675668922-1.el8 - Upgrade
Upgrade
maven/org.jenkins-ci.plugins.workflow:workflow-supportto a version that resolves this vulnerability.Fixed in 839.v35e2736cfd5c - Upgrade
Upgrade
redhat/Pipeline Supporting APIs Pluginto a version that resolves this vulnerability.Fixed in 839.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-43409?
CVE-2022-43409 is classified as a medium severity Cross-site Scripting (XSS) vulnerability.
How do I fix CVE-2022-43409?
To fix CVE-2022-43409, update the Jenkins Pipeline: Supporting APIs Plugin to version 839.v35e2736cfd5c or later.
What causes CVE-2022-43409?
CVE-2022-43409 is caused by insufficient sanitization and encoding of URLs in hyperlinks that send POST requests.
Who is affected by CVE-2022-43409?
CVE-2022-43409 affects users of the Jenkins Pipeline: Supporting APIs Plugin versions 838.va_3a_087b_4055b and earlier.
Can CVE-2022-43409 be exploited remotely?
Yes, CVE-2022-43409 can be exploited by an authenticated remote attacker to create potentially harmful Pipelines.