CVE-2022-43420
Published: 19 October 2022
Summary
CVE-2022-43420 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Jenkins Contrast Continuous Application Security. Its CVSS base score is 5.4 (Medium).
Operationally, ranked in the top 6.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a stored cross-site scripting flaw (CWE-79) affecting the Jenkins Contrast Continuous Application Security Plugin versions 3.9 and earlier. It arises because the plugin fails to escape data returned from the Contrast service when generating reports, allowing untrusted content to be rendered in Jenkins user interfaces.
Attackers able to control or modify responses from the Contrast service API can inject malicious scripts that execute in the context of other Jenkins users who view the generated reports. With a CVSS score of 5.4, successful exploitation can result in limited impacts to confidentiality and integrity without requiring user interaction beyond normal report viewing.
The Jenkins security advisory published on 2022-10-19 and the associated Openwall disclosure detail the issue under SECURITY-2836 and provide the official notification for administrators. The EPSS score reached a peak of 0.1345 with a current value of 0.1172, indicating moderate but not sharply increasing exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-7109
Vulnerability details
Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generating a report, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control or modify Contrast service…
more
API responses.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.