Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Jenkins Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2022-34170 - Vulnerability Database
Jenkins

Jenkins Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2022-34170

Medium
Reference: CVE-2022-34170
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2022-34170
Title: Jenkins Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip effectively undoing the fix for SECURITY-1955 resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.