CVE-2022-43408

描述

Jenkins Pipeline: Stage View Plugin provides a visualization of Pipeline builds. It also allows users to interact with `input` steps from Pipeline: Input Step Plugin. Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of `input` steps when using it to generate URLs to proceed or abort Pipeline builds. This allows attackers able to configure Pipelines to specify `input` step IDs resulting in URLs that would bypass the CSRF protection of any target URL in Jenkins. Pipeline: Stage View Plugin 2.27 correctly encodes the ID of `input` steps when using it to generate URLs to proceed or abort Pipeline builds.

如何修補 CVE-2022-43408

要修補 CVE-2022-43408,請將受影響套件升級到下列已修補版本。

• —升級至 2.27 或更新版本

CVE-2022-43408 正在被利用嗎?

低 — EPSS 為 0.0%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 2.25, < 2.27

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-43408
• WEBgithub.com/jenkinsci/pipeline-stage-view-plugin/commit/cee275109ee748fa9f599ec60159807a28a2933f
• WEBwww.jenkins.io/security/advisory/2022-10-19/#SECURITY-2828
• WEBwww.openwall.com/lists/oss-security/2022/10/19/3