CVE-2022-43409 - Vulnerability Details - OpenCVE

Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Pipelines.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Jenkins	Pipeline\
Redhat	Ocp Tools Openshift

Configuration 1 [-]

cpe:2.3:a:jenkins:pipeline\:_supporting_apis:*:*:*:*:*:jenkins:*:*

Package	CPE	Advisory	Released Date
OCP-Tools-4.12-RHEL-8
jenkins-2-plugins-0:4.12.1675702407-1.el8	cpe:/a:redhat:ocp_tools:4.12::el8	RHSA-2023:1064	2023-03-06T00:00:00Z
OpenShift Developer Tools and Services for OCP 4.11
jenkins-2-plugins-0:4.11.1683009941-1.el8	cpe:/a:redhat:ocp_tools:4.11::el8	RHSA-2023:3198	2023-05-17T00:00:00Z
Red Hat OpenShift Container Platform 4.10
jenkins-2-plugins-0:4.10.1675144701-1.el8	cpe:/a:redhat:openshift:4.10::el8	RHSA-2023:0560	2023-02-08T00:00:00Z
Red Hat OpenShift Container Platform 4.9
jenkins-2-plugins-0:4.9.1675668922-1.el8	cpe:/a:redhat:openshift:4.9::el8	RHSA-2023:0777	2023-02-23T00:00:00Z

References

Link	Providers
http://www.openwall.com/lists/oss-security/2022/10/19/3
https://nvd.nist.gov/vuln/detail/CVE-2022-43409
https://www.cve.org/CVERecord?id=CVE-2022-43409
https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2881

History

Mon, 14 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.01866}`	epss `{'score': 0.0232}`

Thu, 08 May 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: jenkins

Published: 2022-10-19T00:00:00.000Z

Updated: 2025-05-08T19:24:04.903Z

Reserved: 2022-10-18T00:00:00.000Z

Link: CVE-2022-43409

Vulnrichment

Updated: 2024-08-03T13:32:57.389Z

NVD

Status : Modified

Published: 2022-10-19T16:15:10.600

Modified: 2025-05-08T20:15:27.333

Link: CVE-2022-43409

Redhat

Severity : Moderate

Publid Date: 2022-10-19T00:00:00Z

Links: CVE-2022-43409 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-43409", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "assignerShortName": "jenkins", "dateUpdated": "2025-05-08T19:24:04.903Z", "dateReserved": "2022-10-18T00:00:00.000Z", "datePublished": "2022-10-19T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"product": "Jenkins Pipeline: Supporting APIs Plugin", "vendor": "Jenkins project", "versions": [{"lessThanOrEqual": "838.va_3a_087b_4055b", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"status": "unaffected", "version": "827.829.v01c0a_3d76c4f"}]}], "descriptions": [{"lang": "en", "value": "Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Pipelines."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T14:25:36.200Z"}, "references": [{"url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2881"}, {"name": "[oss-security] 20221019 Multiple vulnerabilities in Jenkins plugins", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2022/10/19/3"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:32:57.389Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2881", "tags": ["x_transferred"]}, {"name": "[oss-security] 20221019 Multiple vulnerabilities in Jenkins plugins", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2022/10/19/3"}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-05-08T19:24:01.980704Z", "id": "CVE-2022-43409", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-08T19:24:04.903Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2881", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2022/10/19/3", "name": "[oss-security] 20221019 Multiple vulnerabilities in Jenkins plugins", "tags": ["mailing-list", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:32:57.389Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-43409", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-08T19:24:01.980704Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-08T19:23:57.263Z"}}], "cna": {"affected": [{"vendor": "Jenkins project", "product": "Jenkins Pipeline: Supporting APIs Plugin", "versions": [{"status": "affected", "version": "unspecified", "versionType": "custom", "lessThanOrEqual": "838.va_3a_087b_4055b"}, {"status": "unaffected", "version": "827.829.v01c0a_3d76c4f"}]}], "references": [{"url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2881"}, {"url": "http://www.openwall.com/lists/oss-security/2022/10/19/3", "name": "[oss-security] 20221019 Multiple vulnerabilities in Jenkins plugins", "tags": ["mailing-list"]}], "descriptions": [{"lang": "en", "value": "Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Pipelines."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T14:25:36.200Z"}}}, "cveMetadata": {"cveId": "CVE-2022-43409", "state": "PUBLISHED", "dateUpdated": "2025-05-08T19:24:04.903Z", "dateReserved": "2022-10-18T00:00:00.000Z", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "datePublished": "2022-10-19T00:00:00.000Z", "assignerShortName": "jenkins"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:pipeline\\:_supporting_apis:*:*:*:*:*:jenkins:*:*", "matchCriteriaId": "9261E2B3-F8CB-4996-BF2A-57ADB600A878", "versionEndIncluding": "838.va_3a_087b_4055b", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Pipelines."}, {"lang": "es", "value": "Canalizaci\u00f3n de Jenkins: Supporting APIs Plugin versiones 838.va_3a_087b_4055b y anteriores no sanea o codifica adecuadamente las URLs de los hiperv\u00ednculos que env\u00edan peticiones POST en los registros de construcci\u00f3n, lo que da lugar a una vulnerabilidad de scripting de sitio cruzado (XSS) almacenado explotable por atacantes capaces de crear Pipelines"}], "id": "CVE-2022-43409", "lastModified": "2025-05-08T20:15:27.333", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-10-19T16:15:10.600", "references": [{"source": "jenkinsci-cert@googlegroups.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/10/19/3"}, {"source": "jenkinsci-cert@googlegroups.com", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2881"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/10/19/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2881"}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}