CVE-2022-43420

2022-10-1916:15:11

Google

osv.dev

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

33.3%

JSON

Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generating a report, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control or modify Contrast service API responses.

CPENameOperatorVersion
contrast-continuous-application-security-plugineqcontrast-continuous-application-security-2.6
contrast-continuous-application-security-plugineqcontrast-continuous-application-security-3.6
contrast-continuous-application-security-plugineqcontrast-continuous-application-security-3.8.2
contrast-continuous-application-security-plugineqcontrast-continuous-application-security-2.3
contrast-continuous-application-security-plugineqcontrast-continuous-application-security-1.6
contrast-continuous-application-security-plugineqcontrast-continuous-application-security-1.2
contrast-continuous-application-security-plugineqcontrast-continuous-application-security-2.10
contrast-continuous-application-security-plugineqcontrast-continuous-application-security-3.9
contrast-continuous-application-security-plugineqcontrast-continuous-application-security-3.8
contrast-continuous-application-security-plugineqcontrast-continuous-application-security-3.2

Name	Operator	Version
contrast-continuous-application-security-plugin	eq	contrast-continuous-application-security-2.6
contrast-continuous-application-security-plugin	eq	contrast-continuous-application-security-3.6
contrast-continuous-application-security-plugin	eq	contrast-continuous-application-security-3.8.2
contrast-continuous-application-security-plugin	eq	contrast-continuous-application-security-2.3
contrast-continuous-application-security-plugin	eq	contrast-continuous-application-security-1.6
contrast-continuous-application-security-plugin	eq	contrast-continuous-application-security-1.2
contrast-continuous-application-security-plugin	eq	contrast-continuous-application-security-2.10
contrast-continuous-application-security-plugin	eq	contrast-continuous-application-security-3.9
contrast-continuous-application-security-plugin	eq	contrast-continuous-application-security-3.8
contrast-continuous-application-security-plugin	eq	contrast-continuous-application-security-3.2