Aller au contenu
Se connecter
Non notée

CVE-2022-34171 In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output…

Description

In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability.

Produits et versions touchés

Produit Versions touchées Corrigé en
Jenkins 2.355 premières → 2.355 Pas de correctif indiqué
Jenkins 2.321 2.321 → dernières Pas de correctif indiqué

Autres CVE de Jenkins

Les 153 CVE de Jenkins →
CVE-2026-117626 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the… 4.3 Moyenne CVE-2026-117624 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing… 8.8 Élevée CVE-2026-117625 A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read… 4.3 Moyenne CVE-2026-117623 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar… 5.4 Moyenne
Suivre cette CVE