CVE-2022-41229

2022-09-2116:15:10

Alpine Linux Development Team

security.alpinelinux.org

jenkins

ns-nd integration

xss

configuration options

netstorm

netcloud test

build step

stored vulnerability

attackers

item/configure permission

unix

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

22.8%

JSON

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build step, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

OSVersionArchitecturePackageVersionFilename
Alpine3.16-communitynoarchjenkins= 2.346.2-r0UNKNOWN
Alpine3.17-communitynoarchjenkins= 2.361.2-r0UNKNOWN
Alpine3.18-communitynoarchjenkins= 2.387.3-r0UNKNOWN
Alpine3.19-communitynoarchjenkins= 2.440.3-r0UNKNOWN
Alpine3.20-communitynoarchjenkins= 2.440.2-r0UNKNOWN
Alpineedge-communitynoarchjenkins= 2.462.1-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	3.16-community	noarch	jenkins	= 2.346.2-r0	UNKNOWN
Alpine	3.17-community	noarch	jenkins	= 2.361.2-r0	UNKNOWN
Alpine	3.18-community	noarch	jenkins	= 2.387.3-r0	UNKNOWN
Alpine	3.19-community	noarch	jenkins	= 2.440.3-r0	UNKNOWN
Alpine	3.20-community	noarch	jenkins	= 2.440.2-r0	UNKNOWN
Alpine	edge-community	noarch	jenkins	= 2.462.1-r0	UNKNOWN