cbcvebase.
CVE-2022-43420
published 2022-10-19

CVE-2022-43420: Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generating a report…

PriorityP425medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.78%
55.7th percentile
Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generating a report, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control or modify Contrast service API responses.

Affected

34 ranges· showing 25
VendorProductVersion rangeFixed in
jenkinsbmc_ami_devx_code_debug_code_coverage_plugin——
jenkinsbmc_ami_devx_total_test_plugin——
jenkinsbmc_ami_strobe_measurement_task_plugin——
jenkinscode_pipeline_plugin——
jenkinscompuware_topaz_utilities_plugin——
jenkinscontrast_continuous_application_security< 3.103.10
jenkinscontrast_continuous_application_security_plugin——
jenkinscredentials_plugin——
jenkinscustom_checkbox_parameter_plugin——
jenkinscve-2022-43401_in_script_security_plugin——
jenkinsdeclarative_plugin——
jenkinsdeprecated_groovy_libraries_plugin——
jenkinsfireline_plugin——
jenkinsgeneric_webhook_trigger_plugin——
jenkinsgitlab_plugin——
jenkinsgroovy_libraries_plugin——
jenkinsgroovy_plugin——
jenkinsinput_step_plugin——
jenkinsjob_import_plugin——
jenkinsjob_plugin——
jenkinskatalon_plugin——
jenkinsmercurial_plugin——
jenkinsnunit_plugin——
jenkinsrepo_plugin——
jenkinss3_explorer_plugin——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.