CVE-2022-43408 Jenkins Pipeline: Stage View Plugin allows CSRF protection bypass of any target URL in Jenkins

What is CVE-2022-43408?

CVE-2022-43408 is a medium-severity vulnerability in Jenkins Pipeline: Stage View Plugin, published on 19 Oct 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proceed or abort Pipeline builds, allowing attackers able to configure Pipelines to specify 'input' step IDs resulting in URLs that would bypass the CSRF protection of any target URL in Jenkins.

Weakness: CWE-352

Which versions are affected by CVE-2022-43408?

4 open source packages ship an affected version, including org.jenkins-ci.plugins.pipeline-stage-view:pipeline-stage-view. It affects 1 product.

Products include Jenkins Pipeline\.

How do I fix CVE-2022-43408?

Upgrade org.jenkins-ci.plugins.pipeline-stage-view:pipeline-stage-view to a fixed version for your release line: 2.24.2 or 2.27.

Is CVE-2022-43408 being exploited?

There is no known exploitation of CVE-2022-43408 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Pipeline: Stage View Plugin

• CVE-2019-1003030 Jenkins Matrix Project Plugin Remote Code Execution Exploited Critical 9.9
• CVE-2022-43402 Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution Critical 9.9
• CVE-2019-1003041 Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin Critical 9.8
• CVE-2022-43407 CSRF protection for any URL can be bypassed in Jenkins Pipeline: Input Step Plugin High 8.8
• CVE-2022-25173 Improper Neutralization of Special Elements used in an OS Command in Jenkins Pipeline: Groovy Plugin High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g975-f26h-93g8.