AWS CodeCommit Trigger Plugin up to 3.0.12 on Jenkins Error Message queue name cross site scripting

Summaryinfo

A vulnerability has been found in AWS CodeCommit Trigger Plugin up to 3.0.12 on Jenkins and classified as problematic. This vulnerability affects unknown code of the component Error Message Handler. This manipulation of the argument queue name causes cross site scripting. This vulnerability is handled as CVE-2023-41944. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in AWS CodeCommit Trigger Plugin up to 3.0.12 on Jenkins (Jenkins Plugin). It has been declared as problematic. Affected by this vulnerability is an unknown part of the component Error Message Handler. The manipulation of the argument queue name with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. As an impact it is known to affect integrity. The summary by CVE is:

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message, resulting in an HTML injection vulnerability.

The weakness was released 09/06/2023. It is possible to read the advisory at jenkins.io. This vulnerability is known as CVE-2023-41944 since 09/05/2023. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Jenkins Plugin

Name

• AWS CodeCommit Trigger Plugin

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.0.12

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion