CVE-2022-43434
Severity Score
5.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
Jenkins NeuVector Vulnerability Scanner Plugin versiones 1.20 y anteriores, deshabilita mediante programación la protección de la Política de Seguridad de Contenidos para el contenido generado por el usuario en los espacios de trabajo, artefactos archivados, etc. que Jenkins ofrece para su descarga
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-10-18 CVE Reserved
- 2022-10-19 CVE Published
- 2024-05-11 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2022/10/19/3 | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2865 | 2023-11-22 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Jenkins Search vendor "Jenkins" | Neuvector Vulnerability Scanner Search vendor "Jenkins" for product "Neuvector Vulnerability Scanner" | <= 1.20 Search vendor "Jenkins" for product "Neuvector Vulnerability Scanner" and version " <= 1.20" | jenkins |
Affected
| ||||||