[GHSA-62wf-24c4-8r76] Cross-site Scripting vulnerability in Jenkins

[sunSUNQ]

Updates

• References
• Source code location

Comments
Add patch link and source code location related to CVE-2022-34170.

[shelbyc]

Hi @sunSUNQ, there appears to be an error in the contribution. jenkinsci/jenkins@f71495a is tagged with SECURITY-2779, but GHSA-62wf-24c4-8r76 is linked to SECURITY-2781.

[sunSUNQ]

Hello, in the security advisory, it mentions: SECURITY-2781 / CVE-2022-34170 (SECURITY-2779), CVE-2022-34171 (SECURITY-2761), CVE-2022-34172 (SECURITY-2776), CVE-2022-34173 (SECURITY-2780). I believe CVE-2022-34170 and SECURITY-2779 are related.

[shelbyc]

I see SECURITY-2779 (CVE-2022-34170): Since Jenkins 2.320 and LTS 2.332.1, help icon tooltips no longer escape the feature name, effectively undoing the fix for [SECURITY-1955](https://www.jenkins.io/security/advisory/2020-08-12/#SECURITY-1955). now. Thank you for the clarification.

[advisory-database]

Hi @sunSUNQ! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!