Description

Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.

Remediation

References

CVE-2022-41224

Related Vulnerabilities

Django Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2022-34265)

Magento CVE-2019-8230 Vulnerability (CVE-2019-8230)

WordPress Plugin Gravity Forms Cross-Site Scripting (1.9.5)

WordPress Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-5296)

WordPress Plugin Photo Gallery by Supsystic Multiple Vulnerabilities (1.8.5)

Severity

Medium

Classification

CVE-2022-41224 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities