Lucene search
GoogleOSV:GHSA-7F84-P6R5-JR6QHistoryJun 24, 2022 - 12:00 a.m.
Cross-site Scripting vulnerability in Jenkins
2022-06-2400:00:31
Google
osv.dev
12
0.001 Low
EPSS
Percentile
22.0%
Since Jenkins 2.321 and LTS 2.332.1, the HTML output generated for new symbol-based SVG icons includes the title attribute of l:ionicon until Jenkins 2.334 and alt attribute of l:icon since Jenkins 2.335 without further escaping.
This vulnerability is known to be exploitable by attackers with Job/Configure permission.
Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability, the title attribute of l:ionicon (Jenkins LTS 2.332.4) and alt attribute of l:icon (Jenkins 2.356 and LTS 2.346.1) are escaped in the generated HTML output.
Related
cve
cve
CVE-2022-34171
2022-06-23 17:15:15
cvelist
cvelist
CVE-2022-34171
2022-06-22 14:40:51
prion
prion
Cross site scripting
2022-06-23 17:15:00
alpinelinux
alpinelinux
CVE-2022-34171
2022-06-23 17:15:15
nvd
nvd
CVE-2022-34171
2022-06-23 17:15:15
veracode
veracode
Cross-site Scripting (XSS)
2022-08-20 09:46:35
github
github
Cross-site Scripting vulnerability in Jenkins
2022-06-24 00:00:31
openvas
openvas
osv
osv
BIT-jenkins-2022-34171
2024-03-06 10:57:51
CVE-2022-34171
2022-06-23 17:15:15
cnvd
cnvd
Jenkins Cross-Site Scripting Vulnerability (CNVD-2022-65922)
2022-06-27 00:00:00
redhatcve
redhatcve
CVE-2022-34171
2022-08-19 05:14:42
freebsd
freebsd
jenkins -- multiple vulnerabilities
2022-06-22 00:00:00
nessus
nessus
FreeBSD : jenkins -- multiple vulnerabilities (25be46f0-f25d-11ec-b62a-00e081b7aa2d)
2022-06-23 00:00:00
Jenkins plugins Multiple Vulnerabilities (2022-06-22)
2022-07-15 00:00:00