Description

In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability.

Remediation

References

CVE-2022-34171

Related Vulnerabilities

MySQL CVE-2016-0546 Vulnerability (CVE-2016-0546)

WordPress Plugin HB AUDIO GALLERY LITE Arbitrary File Download (1.0.0)

WordPress Plugin Store Locator Plus for WordPress SQL Injection (3.8.6)

Python Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Vulnerability (CVE-2010-3493)

WordPress Plugin GD bbPress Attachments Cross-Site Scripting (2.5)

Severity

Medium

Classification

CVE-2022-34171 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities