Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2022-34170

In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, eff

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
jenkins

Description

In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Jenkins project Jenkins

  • 2.320 to < unspecifiedaffected
  • unspecified to ≤ 2.355affected
  • LTS 2.332.1 to < unspecifiedaffected
  • unspecified to ≤ LTS 2.332.3affected

References