medium5.4
CVE-2022-45382
Cross-site Scripting in Jenkins Naginator Plugin
Impact
Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to edit build display names. Naginator Plugin 1.18.2 escapes display names of source builds.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:naginator | <= 1.18.1 | 1.18.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Naginator | before 1.18.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2022/11/15/4
- https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2946
- https://github.com/advisories/GHSA-h8hf-hxx6-5g6v
- https://nvd.nist.gov/vuln/detail/CVE-2022-45382
- https://github.com/jenkinsci/naginator-plugin/commit/c335cdd1562333898216bbe137bbe2991c6a225f