CVE-2022-29039 Stored Cross-site Scripting vulnerability in Jenkins Gerrit Trigger Plugin

Medium 5.4 Published 12 Apr 2022 Updated 3 Aug 2024

Stored XSS in Jenkins Gerrit Trigger Plugin allows attackers with configure permissions to inject scripts via parameter names, potentially leading to code execution or account takeover.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-29039?

CVE-2022-29039 is a medium-severity cross-site scripting vulnerability in Jenkins Gerrit Trigger Plugin, published on 12 Apr 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Weakness: CWE-79

Which versions are affected by CVE-2022-29039?

2 open source packages ship an affected version, including com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger. It affects 1 product.

Package	Affected	Fixed in
`com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger` Maven	All versions	`2.35.3`
`com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger` Maven	All versions	`2.35.3`

Products include Jenkins Gerrit Trigger.

How do I fix CVE-2022-29039?

Upgrade com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger to 2.35.3 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-29039 being exploited?

There is no known exploitation of CVE-2022-29039 in the wild and no public exploit code.

Sources

Also known as GHSA-455j-8hg5-8576.