CVE-2022-38664

published 2022-08-23

CVE-2022-38664: Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a…

Priority P4 24 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
jenkins	collabnet_plugins_plugin	—	—
jenkins	git_plugin	—	—
jenkins	job_configuration_history	<= 1165.v8cc9fd1f4597	—
jenkins	job_configuration_history_plugin	—	—
jenkins	kubernetes_continuous_deploy_plugin	—	—
jenkins	yaml_input_files_to_kubernetes_continuous_deploy_plugin	—	—
jenkins_project	jenkins_job_configuration_history_plugin	unspecified – 1165.v8cc9fd1f4597	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79