[MAVEN:GHSA-7QF3-C2Q8-69M3] Reflected XSS vulnerability in Jenkins markup formatter preview
Jenkins allows administrators to choose the markup formatter to use for descriptions of jobs, builds, views, etc. displayed in Jenkins. When editing such a description, users can choose to have Jenkins render a formatted preview of the description they entered.
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering the formatted preview of markup passed as a query parameter. This results in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup, like Anything Goes Formatter Plugin.
Jenkins 2.275, LTS 2.263.2 requires that preview URLs are accessed using POST and sets Content-Security-Policy headers that prevent execution of unsafe elements when the URL is accessed directly.
In case of problems with this change, these protections can be disabled by setting the Java system properties hudson.markup.MarkupFormatter.previewsAllowGET
to true
and/or hudson.markup.MarkupFormatter.previewsSetCSP
to false
. Doing either is discouraged.
Package | Affected Version |
---|---|
pkg:maven/org.jenkins-ci.main/jenkins-core | >= 2.264, <= 2.274 |
pkg:maven/org.jenkins-ci.main/jenkins-core | <= 2.263.1 |
Package | Fixed Version |
---|---|
pkg:maven/org.jenkins-ci.main/jenkins-core | = 2.275 |
pkg:maven/org.jenkins-ci.main/jenkins-core | = 2.263.2 |
- ID
- MAVEN:GHSA-7QF3-C2Q8-69M3
- Severity
- moderate
- URL
- https://github.com/advisories/GHSA-7qf3-c2q8-69m3
- Published
-
2022-05-24T17:39:13
(2 years ago) - Modified
-
2023-12-14T15:39:27
(9 months ago) - Rights
- Maven Security Team
- Other Advisories
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:maven/org.jenkins-ci.main/jenkins-core | org.jenkins-ci.main | jenkins-core | >= 2.264 <= 2.274 | |||
Fixed | pkg:maven/org.jenkins-ci.main/jenkins-core | org.jenkins-ci.main | jenkins-core | = 2.275 | |||
Affected | pkg:maven/org.jenkins-ci.main/jenkins-core | org.jenkins-ci.main | jenkins-core | <= 2.263.1 | |||
Fixed | pkg:maven/org.jenkins-ci.main/jenkins-core | org.jenkins-ci.main | jenkins-core | = 2.263.2 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |