CVE-2022-43435

2022-10-1916:15:12

[email protected]

web.nvd.nist.gov

cve-2022-43435

jenkins

fireline plugin

content security policy

vulnerability

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

33.7%

JSON

Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.

Affected configurations

NVD

Node

jenkins360_firelineRange≤1.7.2jenkins

CPENameOperatorVersion
jenkins:360_firelinejenkins 360 firelinele1.7.2

CPE	Name	Operator	Version
jenkins:360_fireline	jenkins 360 fireline	le	1.7.2

CNA Affected

[
  {
    "product": "Jenkins 360 FireLine Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "1.7.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unknown",
        "version": "next of 1.7.2",
        "versionType": "custom"
      }
    ]
  }
]