What is GHSA-mhp7-3393-pfqr?

GHSA-mhp7-3393-pfqr is a security advisory published by GitHub Security Advisories with High severity. Cross-site Scripting vulnerability in Jenkins

Which CVE IDs does GHSA-mhp7-3393-pfqr cover?

GHSA-mhp7-3393-pfqr covers the following CVE IDs: CVE-2022-34172. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mhp7-3393-pfqr?

GHSA-mhp7-3393-pfqr has a CVSS v3 base score of 8.0, published by GitHub Security Advisories.

Which products are affected by GHSA-mhp7-3393-pfqr?

GHSA-mhp7-3393-pfqr affects 2 products, including: maven/org.jenkins-ci.main:jenkins-core:\u003e= 2.340, \u003c 2.356; maven/org.jenkins-ci.main:jenkins-core:\u003e= 2.332, \u003c 2.332.4.

GHSA-mhp7-3393-pfqrHighCVSS 8.0

Cross-site Scripting vulnerability in Jenkins

Vendor

GitHub Security Advisories

Published

June 24, 2022

Last Modified

January 31, 2023

🔗 CVE IDs covered (1)

CVE-2022-34172 →

📋 Description

Since Jenkins 2.340, symbol-based icons unescape previously escaped values of tooltip parameters.

This vulnerability is known to be exploitable by attackers with Job/Configure permission.

Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability. Symbol-based icons no longer unescape values of tooltip parameters.

🎯 Affected products2

maven/org.jenkins-ci.main:jenkins-core:>= 2.340, < 2.356
maven/org.jenkins-ci.main:jenkins-core:>= 2.332, < 2.332.4

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2022-34172
https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2781
https://github.com/advisories/GHSA-mhp7-3393-pfqr