CVE-2022-43409

Summary

CVE	CVE-2022-43409
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2022-10-19 16:15:00 UTC
Updated	2023-11-01 20:54:00 UTC
Description	Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Pipelines.

Risk And Classification

Problem Types: CWE-79

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Jenkins	Pipeline	_supporting_apis	All	All	All
Application	Jenkins	Supporting Apis	All	All	All	All

References

Reference	Source	Link	Tags
Jenkins Security Advisory 2022-10-19	CONFIRM	www.jenkins.io
oss-security - Multiple vulnerabilities in Jenkins plugins	MLIST	www.openwall.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

241180 Red Hat OpenShift Container Platform 4.10 Security Update (RHSA-2023:0560)
241214 Red Hat OpenShift Container Platform 4.9 Security Update (RHSA-2023:0777)
770173 Red Hat OpenShift Container Platform 4.10 Security Update (RHSA-2023:0560)
770178 Red Hat OpenShift Container Platform 4.9. Security Update (RHSA-2023:0777)