CVE-2022-41225

2022-09-2116:15:09

CWE-79

[email protected]

web.nvd.nist.gov

275

cve-2022-41225

jenkins

anchore

container image scanner

xss

vulnerability

nvd

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

33.5%

JSON

Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control API responses by Anchore engine.

Affected configurations

NVD

Node

jenkinsanchore_container_image_scannerRange<1.0.25jenkins

CPENameOperatorVersion
jenkins:anchore_container_image_scannerjenkins anchore container image scannerlt1.0.25

CPE	Name	Operator	Version
jenkins:anchore_container_image_scanner	jenkins anchore container image scanner	lt	1.0.25

CNA Affected

[
  {
    "product": "Jenkins Anchore Container Image Scanner Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "1.0.24",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]