CVE-2022-41239
Published: 21 September 2022
Summary
CVE-2022-41239 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Jenkins Dotci. Its CVSS base score is 5.4 (Medium).
Operationally, ranked in the top 6.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a stored cross-site scripting flaw (CWE-79) affecting the Jenkins DotCi Plugin in versions 2.40.00 and earlier. The plugin fails to escape the GitHub user name parameter supplied in commit notifications before rendering it within a build cause, allowing attacker-controlled content to be stored and later displayed to users.
An attacker with low privileges can supply a malicious GitHub user name via commit notifications over the network. When another user views the affected build cause, the injected script executes in the victim's browser context, producing limited impacts on confidentiality and integrity with changed scope; user interaction is required for the payload to trigger.
The Jenkins security advisory published on 2022-09-21 under SECURITY-2884 details the issue and associated remediation steps for affected installations.
The EPSS score rose from a low baseline to a peak of 0.2059, indicating emerging exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6911
Vulnerability details
Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.