CVE-2022-34184

CWE-79 — Cross-site Scripting (XSS)5 documents5 sources

Severity

5.4MEDIUM

EPSS

25.9%

top 3.74%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Jenkins Project Jenkins CRX Content Package Deployer Plugin Jenkins CRX Content Package Deployer

Timeline

PublishedJun 23

Latest updateJun 24

Description

Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶Mavenorg.jenkins-ci.plugins:crx-content-package-deployer1.9

▶CVEListV5jenkins_project/jenkins_crx_content_package_deployer_pluginunspecified — 1.9

▶NVDjenkins/crx_content_package_deployer1.9

🔴Vulnerability Details

GHSA

Cross-site Scripting in Jenkins CRX Content Package Deployer Plugin↗2022-06-24

▶

OSV

Cross-site Scripting in Jenkins CRX Content Package Deployer Plugin↗2022-06-24

▶

CVEList

CVE-2022-34184: Jenkins CRX Content Package Deployer Plugin 1↗2022-06-22

▶

📋Vendor Advisories

Jenkins

Jenkins Security Advisory 2022-06-22↗2022-06-22

▶