Patchfirst
Patchfirst
CVE-2022-34783 EPSS 81.8%

Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Jenkins project · Jenkins Plot Plugin

Summary

The Jenkins Plot Plugin, version 2.1.10 and earlier, fails to escape plot descriptions, leaving a stored cross-site scripting flaw in the plugin's plot-rendering component. An attacker holding Item/Configure permission in Jenkins can store malicious script in a plot description, which then runs in the browser of other users who view it.

Heading is the official description · CVE.org
Breakdown
19.9 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 30 Jun 2022. No public exploit code or confirmed exploitation is recorded.

2 fixes in plot over 5 months. The latest fix listed for plot is 2.1.12.

Fixes in plotMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.1.11CVE-2022-3478330 Jun 2022
  2. 2.1.12CVE-2022-466827 Dec 2022Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.jenkins-ci.plugins:plot.

Mavenorg.jenkins-ci.plugins:plotGHSA-hpf7-mmqw-g6vq

Upgrade to 2.1.11 or later

Set the version to 2.1.11 or later in your pom.xml or build.gradle.

The first fix for CVE-2022-34783. No other CVE tracked by Patchfirst affects this package.

Affected versions

If you runUpgrade to
All versions before 2.1.112.1.11

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

1 link, grouped by NVD tag

x_refsource_CONFIRM 1

jenkins.io/security/advisory/2022-06-30/#SECURITY-2220
↑ ↓ chooseEnter openEsc close