Lucene search

GoogleOSV:GHSA-F2J5-W76M-3RQH

HistorySep 22, 2022 - 12:00 a.m.

Jenkins Anchore Container Image Scanner Plugin vulnerable to cross site scripting

2022-09-2200:00:28

Google

osv.dev

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.9 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

32.4%

JSON

Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control API responses by Anchore engine.

CPENameOperatorVersion
org.jenkins-ci.plugins:anchore-container-scannereq1.0.12
org.jenkins-ci.plugins:anchore-container-scannereq1.0.22
org.jenkins-ci.plugins:anchore-container-scannereq1.0.0
org.jenkins-ci.plugins:anchore-container-scannereq1.0.18
org.jenkins-ci.plugins:anchore-container-scannereq1.0.20
org.jenkins-ci.plugins:anchore-container-scannereq1.0.3
org.jenkins-ci.plugins:anchore-container-scannereq1.0.10
org.jenkins-ci.plugins:anchore-container-scannereq1.0.13
org.jenkins-ci.plugins:anchore-container-scannereq1.0.2
org.jenkins-ci.plugins:anchore-container-scannereq1.0.21

Name	Operator	Version
org.jenkins-ci.plugins:anchore-container-scanner	eq	1.0.12
org.jenkins-ci.plugins:anchore-container-scanner	eq	1.0.22
org.jenkins-ci.plugins:anchore-container-scanner	eq	1.0.0
org.jenkins-ci.plugins:anchore-container-scanner	eq	1.0.18
org.jenkins-ci.plugins:anchore-container-scanner	eq	1.0.20
org.jenkins-ci.plugins:anchore-container-scanner	eq	1.0.3
org.jenkins-ci.plugins:anchore-container-scanner	eq	1.0.10
org.jenkins-ci.plugins:anchore-container-scanner	eq	1.0.13
org.jenkins-ci.plugins:anchore-container-scanner	eq	1.0.2
org.jenkins-ci.plugins:anchore-container-scanner	eq	1.0.21

Rows per page:

1-10 of 251

References

github.com/jenkinsci/anchore-container-scanner-plugin

github.com/jenkinsci/anchore-container-scanner-plugin/commit/1b1a62ab8ab86b409274e755860ab4e7fcc11800

nvd.nist.gov/vuln/detail/CVE-2022-41225

www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2821

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.9 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

32.4%

JSON

Related for OSV:GHSA-F2J5-W76M-3RQH